bhouse-nexthop opened a new issue, #14648: URL: https://github.com/apache/cloudstack/issues/14648
### problem `scripts/util/create-kubernetes-binaries-iso.sh` builds the CKS binaries ISO, but it does not pin two of the add-ons it bundles: - **Cluster autoscaler.** The manifest is downloaded from the `master` branch of `kubernetes/autoscaler` (`cluster-autoscaler/cloudprovider/cloudstack/examples/cluster-autoscaler-standard.yaml`, next to a `# TODO : Change the url once merged`). The image bundled is whatever that manifest names, which is `apache/cloudstack-kubernetes-autoscaler:latest`. That tag was last pushed in March 2022 and is a 1.24.0-alpha development build. The cluster-autoscaler only supports the Kubernetes minor version it was released with, so every ISO for Kubernetes 1.25 or later ships an autoscaler built for a different Kubernetes version. - **Cloud controller manager.** The manifest comes from the `main` branch of `apache/cloudstack-kubernetes-provider` (`deployment.yaml`), and the image is whatever `main` names on the day of the build. ISOs built before December 2025 got v1.1.0 this way. v1.1.0 does not initialise nodes (apache/cloudstack-kubernetes-provider#58, fixed in v1.2.0). So two ISOs labelled with the same Kubernetes version can contain different add-ons, and a rebuild can pick up a breaking change without anyone noticing. Nothing in the ISO records which versions it contains. Most of the downloads also use `curl -sSL` or `curl -L` without `-f`, so a 404 is saved as the file and goes into the ISO. #14598 fixes the same kind of download problem in the node-side scripts (`deploy-provider`, `autoscale-kube-cluster`, `deploy-csi-driver`), but leaves the ISO builder and the version pinning alone. ### versions `4.22` and `main`. The autoscaler and CCM URLs are the same on both branches. ### The steps to reproduce the bug 1. Run `scripts/util/create-kubernetes-binaries-iso.sh` for any Kubernetes version, e.g. `1.31.14`. 2. Mount the ISO and look at `autoscaler.yaml` and `provider.yaml`. 3. The autoscaler image is `apache/cloudstack-kubernetes-autoscaler:latest` whatever the Kubernetes version. The CCM image is whatever `main` of `cloudstack-kubernetes-provider` named that day. ### What to do about it? - Download the autoscaler manifest from the `cluster-autoscaler-<version>` release tag that matches the ISO's Kubernetes minor version, and bundle that release's image. - Pin the CCM to a release tag (v1.2.0 or later) and bundle the image of that tag. - Allow both to be overridden when building the ISO. - Write a file into the ISO that lists what it contains. - Use `curl -f` so a failed download stops the build. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
