✨ Check control plane version skew before creating new launch template version #5560

fiunchinho · 2025-06-19T12:53:36Z

/kind feature

What this PR does / why we need it:

This is a draft PR to gather feedback about a potential approach to solve the k8s version skew problem, where AWSMachinePool workers are upgraded to newer k8s versions before the control plane nodes are upgraded.

Release note:

Check control plane version skew before creating new launch template version

k8s-ci-robot · 2025-06-19T12:53:39Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

k8s-ci-robot · 2025-06-19T12:53:44Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign neolit123 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

fiunchinho · 2025-06-19T23:19:37Z

/test all

fiunchinho · 2025-06-20T12:33:05Z

/retest

richardcase

I think this is a good approach to stop upgrading the MachinePools too early.

richardcase · 2025-06-24T09:39:49Z

exp/controllers/awsmachinepool_controller.go

+// isMachinePoolAllowedToUpgradeDueToControlPlaneVersionSkew checks if the control plane is being upgraded, in which case we shouldn't update the launch template.
+func (r *AWSMachinePoolReconciler) isMachinePoolAllowedToUpgradeDueToControlPlaneVersionSkew(clusterScope cloud.ClusterScoper, machinePoolScope *scope.MachinePoolScope) (bool, error) {
+	if machinePoolScope.Cluster.Spec.ControlPlaneRef == nil {
+		return true, nil


I don't think we'd want to proceed in this case with the upgrade.

I changed the logic to return an error in this case, PTAL.

richardcase · 2025-06-24T09:43:38Z

/milestone v2.9

fiunchinho · 2025-07-30T15:47:44Z

/test ?

k8s-ci-robot · 2025-07-30T15:47:47Z

@fiunchinho: The following commands are available to trigger required jobs:

/test pull-cluster-api-provider-aws-build

/test pull-cluster-api-provider-aws-build-docker

/test pull-cluster-api-provider-aws-e2e-blocking

/test pull-cluster-api-provider-aws-test

/test pull-cluster-api-provider-aws-verify

The following commands are available to trigger optional jobs:

/test pull-cluster-api-provider-aws-apidiff-main

/test pull-cluster-api-provider-aws-e2e

/test pull-cluster-api-provider-aws-e2e-clusterclass

/test pull-cluster-api-provider-aws-e2e-conformance

/test pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts

/test pull-cluster-api-provider-aws-e2e-eks

/test pull-cluster-api-provider-aws-e2e-eks-gc

/test pull-cluster-api-provider-aws-e2e-eks-testing

Use /test all to run the following jobs that were automatically triggered:

pull-cluster-api-provider-aws-apidiff-main

pull-cluster-api-provider-aws-build

pull-cluster-api-provider-aws-build-docker

pull-cluster-api-provider-aws-e2e-blocking

pull-cluster-api-provider-aws-test

pull-cluster-api-provider-aws-verify

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

fiunchinho · 2025-07-30T15:48:14Z

/test pull-cluster-api-provider-aws-e2e
/test pull-cluster-api-provider-aws-e2e-eks

fiunchinho · 2025-07-30T16:20:47Z

/test pull-cluster-api-provider-aws-test

…version

fiunchinho · 2025-07-30T16:25:54Z

/test pull-cluster-api-provider-aws-e2e
/test pull-cluster-api-provider-aws-e2e-eks

fiunchinho · 2025-07-30T17:56:40Z

/retest

nrb · 2025-08-18T19:53:59Z

exp/controllers/awsmachinepool_controller.go

+
+	cpVersion, found, err := unstructured.NestedString(controlPlane.Object, "status", "version")
+	if !found || err != nil {
+		return false, errors.Wrapf(err, "failed to get version of ControlPlane %s", machinePoolScope.Cluster.Spec.ControlPlaneRef.Name)


With the || here, is it possible that we'll get a case where !found = true && err == nil? That may cause an issue when generating the wrapped error here.

nrb · 2025-08-18T20:00:34Z

exp/controllers/awsmachinepool_controller_test.go

+				asgSvc.EXPECT().CanStartASGInstanceRefresh(gomock.Any()).Times(0)
+				// Won't be called due to version skew
+				ec2Svc.EXPECT().CreateLaunchTemplateVersion(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Times(0)
+				// Won't be called due to version skew


Appreciate these comments, thank you!

AndiDog · 2025-09-03T11:12:28Z

We found this doesn't work if the MachinePool object still hasn't been updated. The patched logic then thinks MachinePool.spec.template.spec.version to be the desired version, but it's outdated and this might again lead to unwanted worker rollouts with too new Kubernetes version.

This patch improves the situation if the objects are deployed around the same time (before reconciliation runs), so I think we could keep it as a first step in the right direction. For a full skew check, we'd need to synchronize the MachinePool and AWSMachinePool objects, for example using a common field or label.

@fiunchinho One more question on behavior: The patch avoids the instance refresh. But what if the ASG scales up or replaces instances – would they have the new Kubernetes version? Also, we currently get return errors.New("Cannot update the launch template, prerequisite not met") – probably fine, but maybe we should fill the condition with a good reason text (returned by canUpdateLaunchTemplate()?!).

fiunchinho · 2025-09-09T15:34:52Z

@fiunchinho One more question on behavior: The patch avoids the instance refresh. But what if the ASG scales up or replaces instances – would they have the new Kubernetes version? Also, we currently get return errors.New("Cannot update the launch template, prerequisite not met") – probably fine, but maybe we should fill the condition with a good reason text (returned by canUpdateLaunchTemplate()?!).

It prevents creating a new launch template version, so new nodes (even when scaling up) won't get the new k8s version.

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jun 19, 2025

k8s-ci-robot requested review from cnmcavoy and nrb June 19, 2025 12:53

fiunchinho changed the title ~~Check control plane version skew before creating new launch template …~~ Check control plane version skew before creating new launch template version Jun 19, 2025

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jun 19, 2025

fiunchinho changed the title ~~Check control plane version skew before creating new launch template version~~ ✨ Check control plane version skew before creating new launch template version Jun 19, 2025

fiunchinho force-pushed the control-plane-skew branch from d872e60 to ebb7acc Compare June 19, 2025 13:04

fiunchinho changed the title ~~✨ Check control plane version skew before creating new launch template version~~ WIP: ✨ Check control plane version skew before creating new launch template version Jun 19, 2025

fiunchinho force-pushed the control-plane-skew branch 2 times, most recently from 09f90d8 to 8a507ce Compare June 19, 2025 23:19

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 19, 2025

fiunchinho changed the title ~~WIP: ✨ Check control plane version skew before creating new launch template version~~ ✨ Check control plane version skew before creating new launch template version Jun 19, 2025

fiunchinho force-pushed the control-plane-skew branch from 8a507ce to 5e4e6e8 Compare June 20, 2025 12:32

fiunchinho marked this pull request as ready for review June 23, 2025 07:48

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 23, 2025

k8s-ci-robot requested a review from dlipovetsky June 23, 2025 07:48

richardcase reviewed Jun 24, 2025

View reviewed changes

k8s-ci-robot added this to the v2.9 milestone Jun 24, 2025

fiunchinho force-pushed the control-plane-skew branch from 5e4e6e8 to 5b92730 Compare July 30, 2025 15:47

Check control plane version skew before creating new launch template …

c4d8dc1

…version

fiunchinho force-pushed the control-plane-skew branch from 5b92730 to c4d8dc1 Compare July 30, 2025 16:25

nrb reviewed Aug 18, 2025

View reviewed changes

AndiDog mentioned this pull request Sep 4, 2025

Kubernetes version skew check for machine pools kubernetes-sigs/cluster-api#12732

Open

✨ Check control plane version skew before creating new launch template version #5560

Are you sure you want to change the base?

✨ Check control plane version skew before creating new launch template version #5560

Conversation

fiunchinho commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jun 19, 2025

Uh oh!

k8s-ci-robot commented Jun 19, 2025

Uh oh!

fiunchinho commented Jun 19, 2025

Uh oh!

fiunchinho commented Jun 20, 2025

Uh oh!

richardcase left a comment

Choose a reason for hiding this comment

Uh oh!

richardcase Jun 24, 2025

Choose a reason for hiding this comment

Uh oh!

fiunchinho Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

richardcase commented Jun 24, 2025

Uh oh!

fiunchinho commented Jul 30, 2025

Uh oh!

k8s-ci-robot commented Jul 30, 2025

Uh oh!

fiunchinho commented Jul 30, 2025

Uh oh!

fiunchinho commented Jul 30, 2025

Uh oh!

fiunchinho commented Jul 30, 2025

Uh oh!

fiunchinho commented Jul 30, 2025

Uh oh!

nrb Aug 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nrb Aug 18, 2025

Choose a reason for hiding this comment

Uh oh!

AndiDog commented Sep 3, 2025

Uh oh!

fiunchinho commented Sep 9, 2025

Uh oh!

Uh oh!

fiunchinho commented Jun 19, 2025 •

edited

Loading

nrb Aug 18, 2025 •

edited

Loading