github-actions[bot] commented on issue #14650: URL: https://github.com/apache/cloudstack/issues/14650#issuecomment-6802608938
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/43029422543) for details. > > </details> ## 🎯 Triage report CKS never renews or checks the kubeadm control plane certificates, which expire after one year. Upgrades renew them as a side effect, but the stored kubeconfig is not refreshed afterwards, so downloads keep a certificate that expires on the original date. The reporter asks for a stored-kubeconfig refresh after upgrade and renewal, periodic expiry checks with alerts, a renewal API, and optional automatic renewal. Open PR #14651 is linked to this issue. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:enhancement | New renewal and monitoring behaviour, plus a stale-data fix | | **Component** | component:cks | CKS cluster certificates and stored kubeconfig | | **Severity** | n/a | Expiry is a year out; the reporter describes it as a missing capability | | **Labels** | type:enhancement, component:cks | | | **Coding agent** | Not suitable | Renewal API, alerting and automatic renewal are design decisions; PR #14651 already covers them | ### 🔗 Similar issues - #14181 (related) — CKS kubeadm config API version breaks external-etcd clusters on newer Kubernetes - #14213 (related) — CKS nodes report stale capacity after live resize; similar stale-state concern <details> <summary>💡 Notes and suggestions</summary> - Check: `sudo /opt/bin/kubeadm certs check-expiration` on a control node, then `getKubernetesClusterConfig`, then decode `client-certificate-data`. - The stored-kubeconfig refresh after upgrade could be split from the renewal and alerting work. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/43029422543) · copilot · haiku55 · \~6 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 43029422543, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/43029422543 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"43029422543","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/43029422543","publishing_job":{"key":"safe_outputs","check_run_id":"130687254582"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
