eebb6c8594
The nightly upgrade chain detected 1.36, the preflight compat-gate refused it,
and that produced a Failed preflight Job + a K8sUpgradeBlocked alert EVERY
night — even though the block is unactionable (no kyverno/ESO release supports
1.36 yet, and gpu-operator is pinned to its current version because bumping it
needs a newer NVIDIA driver image + Ubuntu/kernel we're not ready for). Viktor
asked to teach the checker to tell 'we can fix this' apart from 'nothing to do
but wait', and stop the nightly Failed-Job + alert noise for the latter.
compat-gate.py now classifies each blocker:
- ACTIONABLE: a newer addon version in addon-compat.json supports the target
-> exit 2, k8s_upgrade_blocked=1 -> K8sUpgradeBlocked alert (reasons in the
nightly report).
- WAITING-on-upstream: no released version supports the target yet -> held.
- PINNED: addon marked pinned in the matrix (gpu-operator) -> held.
Held wins on a mix -> exit 4, k8s_upgrade_held=1 (NEW gauge), NO alert.
Tidy the block path (Viktor's scope choice): deliberate gate decisions now make
the preflight Job Complete cleanly (HALT_CHAIN stops chain progression without a
non-zero exit), so they no longer create Failed Jobs. Dropped the now-obsolete
'unless k8s_upgrade_blocked==1' suppression from K8sUpgradeChainJobFailed. Gauge
is pushed definitively once per run (no 1->0->1 flap that re-notifies). The
detector re-spawns a refused-but-Complete preflight nightly (silently) so a
standing hold still re-evaluates, and only announces genuine new/Failed spawns.
nightly-report gains a quiet '⏸️ HELD' headline with reasons grouped by class.
gpu-operator pinned in addon-compat.json (unpin = delete pinned + pin_reason).
Net effect on 1.36: HELD + quiet (waiting on kyverno/ESO, gpu-operator pinned;
Calico the lone actionable piece) — no nightly Failed Job, no alert, just the
morning report's HELD line. Design: docs/plans/2026-06-28-k8s-upgrade-gate-held-classification.md
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.4 KiB
JSON
59 lines
2.4 KiB
JSON
{
|
|
"_comment": "Addon -> highest k8s minor each addon version supports. The preflight compat-gate (compat-gate.py) reads the RUNNING version of each addon and blocks a k8s upgrade whose target minor exceeds what that running version supports — so the chain auto-halts + alerts instead of breaking on an unsupported addon. Keep current; sources are the addons' own k8s compat matrices (last refreshed 2026-06-19 for the 1.34->1.36 catch-up). max_k8s keys are addon-version floors (major.minor); value is the highest k8s minor that floor supports. An addon entry may also set \"pinned\": true (+ \"pin_reason\") to mark it deliberately held: the gate classifies its block as PINNED/held (quiet — no alert, nightly report only) even if a supporting version exists, for upgrades coupled to other work we're not ready for (e.g. gpu-operator's NVIDIA-driver/Ubuntu coupling). A block with NO supporting version in the matrix is WAITING (also quiet); a block a newer matrix version would clear is ACTIONABLE (alerts).",
|
|
"addons": [
|
|
{
|
|
"name": "calico",
|
|
"namespace": "calico-system",
|
|
"kind": "daemonset",
|
|
"resource": "calico-node",
|
|
"image_re": "node:v?([0-9]+\\.[0-9]+)",
|
|
"max_k8s": {
|
|
"3.26": "1.28",
|
|
"3.27": "1.29",
|
|
"3.28": "1.30",
|
|
"3.29": "1.32",
|
|
"3.30": "1.35",
|
|
"3.31": "1.35",
|
|
"3.32": "1.36"
|
|
}
|
|
},
|
|
{
|
|
"name": "external-secrets",
|
|
"namespace": "external-secrets",
|
|
"kind": "deployment",
|
|
"resource": "external-secrets",
|
|
"image_re": "external-secrets:v?([0-9]+\\.[0-9]+)",
|
|
"max_k8s": {
|
|
"0.12": "1.31",
|
|
"2.0": "1.35"
|
|
}
|
|
},
|
|
{
|
|
"name": "kyverno",
|
|
"namespace": "kyverno",
|
|
"kind": "deployment",
|
|
"resource": "kyverno-admission-controller",
|
|
"image_re": "kyverno:v?([0-9]+\\.[0-9]+)",
|
|
"max_k8s": {
|
|
"1.16": "1.34",
|
|
"1.18": "1.35"
|
|
}
|
|
},
|
|
{
|
|
"name": "gpu-operator",
|
|
"namespace": "nvidia",
|
|
"kind": "deployment",
|
|
"resource": "gpu-operator",
|
|
"image_re": "gpu-operator:v?([0-9]+\\.[0-9]+)",
|
|
"max_k8s": {
|
|
"25.10": "1.35",
|
|
"26.3": "1.36"
|
|
},
|
|
"pinned": true,
|
|
"pin_reason": "26.3 needs a newer NVIDIA driver image + Ubuntu/kernel; held until the driver/OS path is ready. Unpin = delete pinned + pin_reason."
|
|
}
|
|
],
|
|
"containerd_min": {
|
|
"1.37": "2.0"
|
|
}
|
|
}
|