github-actions[bot] commented on issue #14610: URL: https://github.com/apache/cloudstack/issues/14610#issuecomment-6744186756
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/42625769126) for details. > > </details> ## ๐ฏ Triage report CKS drains nodes before scale-down and upgrade, and both paths handle a failed or slow drain poorly. On scale-down, one failed drain (for example a PodDisruptionBudget) gives up without retry and leaves the node cordoned, and the cluster moves to Alert although no node was removed. On upgrade, a failed drain is retried at once, the node is left cordoned, only the first control node is waited on, and the upgrade script can reach the wrong node through the SSH port-forward rules. A failed upgrade also leaves the cluster in Alert, where `upgradeKubernetesCluster` refuses to run again. ### ๐ Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | Drain and upgrade failures, with reproduction steps | | **Component** | component:cks | Scale and upgrade workers in the CKS plugin | | **Severity** | Severity:Major | Failed drains leave clusters in Alert and failed upgrades cannot be resumed | | **Labels** | type:bug, component:cks, Severity:Major | | | **Coding agent** | Needs more info | Several separate changes (drain helper, scale-down ordering, upgrade SSH mapping, resume); maintainers should confirm scope | ### ๐ Similar issues - #14608 (related) โ concurrent CKS operations clobber state - #14603 (related) โ CKS cluster in Alert cannot be scaled - #14244 (related) โ CKS upgrade fails on control node with a different dashboard manifest - #14148 (related) โ CKS upgrade fails in a similar scenario <details> <summary>๐ก Notes and suggestions</summary> - Reproduction for scale-down: a PodDisruptionBudget that allows no disruption on the worker a scale-down would remove. - The report lists four separate fixes; splitting them into smaller items may help review. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/42625769126) ยท copilot ยท haiku55 ยท \~4 AIC ยท โ 3.8K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 42625769126, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/42625769126 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"42625769126","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/42625769126","publishing_job":{"key":"safe_outputs","check_run_id":"129262122857"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
