fix(kubernetes): fail fast on cluster_name change for existing clusters - #13466
fix(kubernetes): fail fast on cluster_name change for existing clusters#13466mehrdadbn9 wants to merge 2 commits into
Conversation
…balls
gvisor changed its release artifacts: the per-arch binary .sha512 files
under storage.googleapis.com/gvisor/releases/release/{version}/{arch}/
no longer exist for new releases, so the update-hashes script fails
with HTTP 404 and new gvisor versions cannot be added.
Since release-20260817.0, gvisor publishes GitHub releases containing
gvisor-{arch}.tar.bz2 archives plus SHA256SUMS and SHA512SUMS files.
- replace gvisor_runsc_binary and gvisor_containerd_shim_binary entries
in component_hash_update with a single gvisor_archive entry pointing
at the GitHub release SHA512SUMS file, with an extractor that maps
the two tarball hashes to x86_64/aarch64
- collapse the two download definitions (gvisor_runsc,
gvisor_containerd_shim) into one gvisor_archive download with
unarchive enabled
- copy runsc and containerd-shim-runsc-v1 from the extracted gvisor/
directory in the gvisor role
- add gvisor_archive_checksums for release-20260817.0 (amd64/arm64)
The old per-arch checksum variables remain as aliases so the checksum
data in vars/main/checksums.yml keeps resolving during the transition.
Fixes: kubernetes-sigs#13460
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
Changing cluster_name on an already-deployed cluster invalidates the certificate issuer, the JWT token issuer used by the API server and the identity asserted to the CNI plugin, which breaks pod networking and authentication cluster-wide without any warning from kubespray. Add an early guard in kubeadm-setup.yml: when kubeadm has already run on the node and admin.conf is present, extract the cluster name that kubeadm wrote into it and fail with an actionable message if it differs from the configured cluster_name. First installations never reach the guard (kubeadm_already_run is false), and if admin.conf was moved away the guard skips instead of failing. Fixes: kubernetes-sigs#13233 Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
kubernetes-prow
Bot
added
release-note
|
Hi @mehrdadbn9. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mehrdadbn9 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubernetes-prow
Bot
added
needs-ok-to-test
|
There is a reson why previous attempt stopped or failed(maybe?): #13242 (comment) Also the files changed in this PR have changes from #13465. |
|
Also, please don't just dump an issue number into an AI tool and ask it to write a fix. It's really important to manually read the issue, investigate the related files, and properly test the changes yourself. |
2 participants
What type of PR is this?
/kind bug
What this PR does / why we need it:
Changing
cluster_namein inventory and re-running kubespray against an existing cluster silently invalidates the certificate issuer, the service-account JWT issuer and the identity the CNI plugin asserts, breaking authentication and pod networking cluster-wide (issue reporter lost calico + auth entirely).This adds an early guard in
kubeadm-setup.yml: when kubeadm has already run on the node andadmin.confis present, the cluster name kubeadm wrote into it is compared with the configuredcluster_name, and the playbook fails fast with an actionable message instead of applying the change.kubeadm_already_runis true)admin.confwas moved/renamed by the operator, the guard skips rather than failingWhich issue(s) this PR fixes:
Fixes #13233
Special notes for your reviewer:
Verified locally with ansible-playbook 2.16 against a stubbed config tree: mismatch fails with the message, match continues, missing admin.conf skips. Full-role
ansible-playbook --syntax-checkpasses.