github-actions[bot] commented on issue #14673: URL: https://github.com/apache/cloudstack/issues/14673#issuecomment-6802608408
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/43029422543) for details. > > </details> ## ๐ฏ Triage report After nodes are added with `addNodesToKubernetesCluster`, a later scale-up that increases the managed node count fails while rebuilding the SSH firewall rules. The new range overlaps the single-port rule of an imported node, and the rules conflict check rejects it. By then the old SSH rule and the port forwarding rules have been removed, and the cluster returns to Running without restoring them, so later operations such as upgrade may not reach the managed nodes. The reporter found this by reading code and has not reproduced it. ### ๐ Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | Failed scale-up leaves SSH access removed; reported from code analysis | | **Component** | component:cks | SSH firewall rules in the CKS scale worker | | **Severity** | Severity:Major | Cluster appears healthy while managed nodes are unreachable for SSH | | **Labels** | type:bug, component:cks, Severity:Major | Not yet reproduced, so confidence is medium | | **Coding agent** | Needs more info | Not reproduced; the change must be coordinated with #14165 | ### ๐ Similar issues - #14159 (related) โ scale-down with separate etcd revokes the wrong SSH rules; same `removeSshFirewallRule` area - #13970 (related) โ make the source CIDR of auto-provisioned SSH rules configurable - #14668 (related) โ CKS on a VPC tier with the Firewall service; the reporter notes the same rules would apply there <details> <summary>๐ก Notes and suggestions</summary> - Reproduction (from the report): isolated network, 1 control and 1 worker, add an imported node, then scale to 2 workers. Check the firewall rules and port forwards after the failed scale. - A regression test that imports a node and then scales up would cover the case. - Coordinate with #14165, which also changes `removeSshFirewallRule`. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/43029422543) ยท copilot ยท haiku55 ยท \~6 AIC ยท โ 3.8K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 43029422543, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/43029422543 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"43029422543","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/43029422543","publishing_job":{"key":"safe_outputs","check_run_id":"130687254582"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
