PCP-6608: cluster-api-provider-maas wipes API server FQDN empty IP set persisted to MAAS DNS when CP machine is transiently powered off, hash-cached so no self-recovery

[AmitSahastra]

Problem

When a control-plane MaasMachine was briefly in Deployed (powered off) state, reconcileDNSAttachments() built an empty desired-IP set, PUT it to the MAAS DNSResource (wiping all A records), and persisted SHA-256("") as last-applied-dns-hash. Subsequent reconciles
saw no hash drift and returned early — DNS stayed empty with no self-recovery path. Workers lost connectivity to the API server FQDN, CNI never initialized, and the controller pod itself eventually went Unknown (chicken-and-egg).

Confirmed on vmo-eng-2025 (VMO Eng PCG): DNS wiped at 16:52:22 UTC, made visible by an unrelated power outage at 18:02 UTC. The e3b0c44…b855 annotation (SHA-256 of empty string) was the forensic indicator.

Changes

controllers/maascluster_controller.go

• Empty-IP guard (primary fix): If runningIpAddresses is empty after filtering, return immediately without touching DNS or updating the hash annotation. The existing MAAS A records are preserved through the flap. When the CP recovers, the annotation hash will
  differ from the new desired set and DNS is corrected on the next reconcile.
• Improved log messages: Track runningCPCount separately from machines with eligible IPs. Log messages now distinguish two silent-failure modes: "no running CP machines" (power-off flap) vs "CP machines running but no IPs match preferred subnets"
  (misconfiguration).
• MAAS drift detection: DNS resource is fetched before the hash check. When the annotation hash matches, MAAS state is still verified via IsDriftDetected(). If MAAS has drifted (e.g. records manually wiped while desired set was unchanged), the controller forces a
  re-sync instead of returning early forever.

pkg/maas/dns/dns.go

• IsDriftDetected(): New method comparing a pre-fetched DNS resource's current IP set against a desired list. Used by the controller's drift check.
• Defence-in-depth guard in updateResourceIPs(): Returns an error if the desired set is empty, so any future caller that bypasses the controller-level guard cannot accidentally wipe DNS.

Failure modes addressed

Remaining gap (not in this PR)

If preferredSubnets is misconfigured such that all CP IPs are always filtered, DNS is preserved but no IP is ever written. The log message now surfaces this explicitly; a follow-up could add a condition/event on the MaasCluster object.

Tests:

• Empty-IP guard with existingCPCount / runningCPCount distinction
• MAAS drift detection and recovery
• IP deduplication before hashing

Unit Tests:

• TestIsRunning — All machine states including nil state
• TestIsControlPlaneMachine — CP label detection
• TestGetExternalMachineIP — Subnet filtering
• TestReconcileDNSAttachments:
◦ CP powered off → DNS preserved
◦ No CP machines → DNS cleared
◦ CP with DeletionTimestamp → DNS cleared
◦ CP running but no ExternalIP → DNS preserved
◦ CP running, no prior annotation → DNS updated
◦ Hash match + MAAS in sync → skip update
◦ Hash match + MAAS drifted → force re-sync
◦ GetDNSResource error propagated
• IsDriftDetected tests — matching IPs, empty MAAS, different IPs, extra IPs, duplicates, empty strings

[bulwark-spectrocloud]

⚠️ GoVulnCheck scan found vulnerabilities:

1. GO-2026-4918
   • Module: golang.org/x/net
   • Found in: v0.38.0
   • Fixed in: v0.53.0
   • Example Traces:
     1. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     2. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     3. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     4. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http2.run

Please review these findings and fix the issues before merging.

[Copilot]

Pull request overview

Fixes a control-plane DNS wipe scenario in the MAAS provider by preventing reconciles from PUT’ing an empty IP set (and caching the empty hash), and adds drift detection so MAAS-side changes can be corrected even when the last-applied annotation hasn’t changed.

Changes:

• Add an empty-desired-IP guard in reconcileDNSAttachments() to preserve existing DNS records during transient CP unavailability.
• Add MAAS drift detection by fetching the DNS resource before hash short-circuiting and forcing a re-sync when MAAS diverges.
• Add DNS-layer defense-in-depth to refuse updating a MAAS DNS resource with an empty desired IP set.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
controllers/maascluster_controller.go	Avoids empty-IP updates, improves logging, and adds drift-aware early-exit logic for DNS attachment reconciliation.
pkg/maas/dns/dns.go	Adds drift comparison helper and prevents updating MAAS DNS resources with an empty desired IP set.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bulwark-spectrocloud]

⚠️ GoVulnCheck scan found vulnerabilities:

1. GO-2026-4918
   • Module: golang.org/x/net
   • Found in: v0.38.0
   • Fixed in: v0.53.0
   • Example Traces:
     1. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     2. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     3. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http2.run
     4. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip

Please review these findings and fix the issues before merging.

[bulwark-spectrocloud]

⚠️ GoVulnCheck scan found vulnerabilities:

1. GO-2026-4918
   • Module: golang.org/x/net
   • Found in: v0.38.0
   • Fixed in: v0.53.0
   • Example Traces:
     1. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     2. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     3. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http.roundTrip
     4. pkg/maas/dns/dns.go:52:10: dns.ReconcileDNS calls maasclient.Create, which eventually calls http2.run

Please review these findings and fix the issues before merging.

Changes have been made to address the security findings.