infra/stacks/k8s-version-upgrade/scripts
Viktor Barzin 566447a698
All checks were successful
ci/woodpecker/push/default Pipeline was successful
k8s-upgrade: preflight kubeadm-plan gate must pass explicit target (minor-upgrade fix)
Last night's 1.34.9->1.35.6 run passed the ESO/kyverno compat gate (the migration
worked!) but ABORTED at the kubeadm-plan-target gate: it ran `kubeadm upgrade plan`
with NO version, so master's old 1.34.9 kubeadm auto-proposed only the current
minor (Loki: "falling back to stable-1.34") and plan_target != 1.35.6 -> abort.
That gate worked for patch upgrades but never for minors. Fix: pass the explicit
`v$TARGET_VERSION` (verified on master: `kubeadm upgrade plan v1.35.6` emits
"kubeadm upgrade apply v1.35.6"). Works for patches too. Applied live to the
ConfigMap before tonight's run; deleted the failed preflight-1-35-6 job.

Also: ESO 2.x took SSA ownership of .spec.refreshInterval, so terraform's apply of
the k8s-upgrade-creds ExternalSecret hit a field-manager conflict. Added
field_manager.force_conflicts=true (benign — interval is semantically identical).
This pattern affects all 104 migrated ESs fleet-wide (follow-up).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 06:06:14 +00:00
..
addon-compat.json k8s-version-upgrade: compat gate — auto-upgrade when safe, halt + alert when not 2026-06-19 11:23:30 +00:00
compat-gate.py k8s-version-upgrade: compat gate must not false-block patch upgrades 2026-06-20 08:14:50 +00:00
nightly-report.py k8s-upgrade: nightly Slack report monitor + scope chain-failed alert to phases 2026-06-21 16:57:44 +00:00
test_compat_gate.py k8s-version-upgrade: compat gate must not false-block patch upgrades 2026-06-20 08:14:50 +00:00
test_nightly_report.py k8s-upgrade: nightly Slack report monitor + scope chain-failed alert to phases 2026-06-21 16:57:44 +00:00
upgrade-step.sh k8s-upgrade: preflight kubeadm-plan gate must pass explicit target (minor-upgrade fix) 2026-06-24 06:06:14 +00:00