Skip to content

fix(acl): wait for Node registration before starting TAA #9960

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bfjelds (bfjelds) wants to merge 6 commits into from
+26 −0
Closed

fix(acl): wait for Node registration before starting TAA #9960

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f08ddab
fix(acl): wait for Node registration before starting TAA
bfjelds Oct 30, 2026
85740f0
test(acl): remove Node preflight spec
bfjelds Oct 30, 2026
86ecad2
docs(acl): simplify TAA preflight comment
bfjelds Oct 30, 2026
59bd8ce
fix(acl): lowercase the Node preflight hostname
bfjelds Oct 30, 2026
9afb465
fix(acl): wait for local kubelet TLS bootstrap
bfjelds Nov 2, 2026
fd3ca08
fix(acl): confirm Node registration after kubelet bootstrap
bfjelds Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions parts/linux/cloud-init/artifacts/acl/trident-acl-agent-override.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,3 +42,29 @@ ExecStartPre=-/usr/bin/sh -c '\
for p in /var/lib/kubelet/kubeconfig /run/trident/trident.sock; do \
[ -e "$p" ] && echo "trident-acl-agent preflight: present $p" || echo "trident-acl-agent preflight: MISSING $p"; \
done'

# Wait for kubelet TLS bootstrapping without polling the API server.
TimeoutStartSec=150s
ExecStartPre=/usr/bin/sh -c '\
cert=/var/lib/kubelet/pki/kubelet-client-current.pem; \
for i in $$(seq 1 60); do \
if [ -f /var/lib/kubelet/kubeconfig ] && [ -L "$$cert" ] && [ -f "$$cert" ]; then \
Comment thread
bfjelds marked this conversation as resolved.
Resolved
echo "trident-acl-agent preflight: kubelet TLS bootstrapping complete after $$i check(s)"; exit 0; \
fi; \
sleep 1; \
done; \
echo "trident-acl-agent preflight: kubelet TLS bootstrapping incomplete after 60 checks" >&2; \
exit 1'

# TLS bootstrapping can finish before Node registration. Wait locally, then
# confirm the Node exists with one API request.
ExecStartPre=/usr/bin/timeout 60s /usr/bin/sh -ec '\
until journalctl -b -u kubelet.service --no-pager -q -o cat \
--grep="Successfully registered node" -n 1 | grep -q .; do \
sleep 1; \
Comment on lines +62 to +64
done; \
sleep 1; \
node="$$(hostname | tr "[:upper:]" "[:lower:]")"; \
/opt/bin/kubectl --kubeconfig /var/lib/kubelet/kubeconfig \
--request-timeout=5s get node "$$node" >/dev/null; \
echo "trident-acl-agent preflight: Node $$node registration confirmed"'
Loading