Skip to content

CKS: prevent individual Instance compute offering changes on managed cluster nodes - #14605

Open
andrijapanicsb wants to merge 2 commits into
apache:mainfrom
andrijapanicsb:cks-14553-block-node-offering-changes
Open

andrijapanicsb wants to merge 2 commits into
apache:mainfrom
andrijapanicsb:cks-14553-block-node-offering-changes

Conversation

@andrijapanicsb

Copy link
Copy Markdown
Contributor

CloudManaged Kubernetes nodes can currently be resized individually through the Instances view or VM APIs.
This leaves the VM resources out of sync with the cluster configuration and reported capacity and later messes up cluster-level scaling.

This change prevents individual compute offering changes for those nodes. Resizing remains available through the Kubernetes cluster scaling operations. Ordinary instances and ExternalManaged clusters retain their existing behaviour.

Fixes #14553

Changes

  • Add compute offering validation to KubernetesServiceHelper, following the existing CKS validation patterns.
  • Apply the validation to scaleVirtualMachine and the deprecated changeServiceForVirtualMachine API, including administrator variants.
  • Check cluster membership so the restriction also covers adopted nodes.
  • Include the cluster management type in VM responses and hide the Instances scale action for CloudManaged members.

Cluster scaling

Validation is limited to the VM API entry points. Internal offering-change methods remain unchanged for cluster-wide and node-group resizing, including the paths used by #14223.

Tests

Tests cover blocked API operations, permitted ordinary and ExternalManaged instances, adopted nodes, UI visibility, and internal stopped/live resizing.

Scope

This change guards compute offering replacement. Dynamic resource changes through updateVirtualMachine details and the resource-detail APIs remain separate follow-up work.

Validate compute offering changes at both VM API entry points and hide
individual scaling for CloudManaged Kubernetes cluster members.

Keep ExternalManaged and ordinary instances unchanged, and preserve the
internal resizing methods used by CKS cluster and node-type scaling.

Fixes: apache#14553
Signed-off-by: Andrija Panic <andrija.panic@gmail.com>
@andrijapanicsb

Copy link
Copy Markdown
Contributor Author

@ACSHomeBot package

@ACSHomeBot

ACSHomeBot commented Nov 7, 2026 •

Copy link
Copy Markdown

Accepted: package kvm for 60a442fd06c0.

Planned: RPM + DEB, KVM SystemVM.

Status: Completed. Packaging results.

@codecov

codecov Bot commented Nov 7, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 3.88%. Comparing base (fb60564) to head (a263ee2).

❗ There is a different number of reports uploaded between BASE (fb60564) and HEAD (a263ee2). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (fb60564) HEAD (a263ee2)
unittests 1 0
Additional details and impacted files
@@              Coverage Diff              @@
##               main   #14605       +/-   ##
=============================================
- Coverage     20.78%    3.88%   -16.90%     
=============================================
  Files          6496      493     -6003     
  Lines        591657    42571   -549086     
  Branches      72592     8069    -64523     
=============================================
- Hits         122966     1655   -121311     
+ Misses       455346    40685   -414661     
+ Partials      13345      231    -13114     
Flag Coverage Δ
uitests 3.88% <ø> (+<0.01%) ⬆️
unittests ?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ACSHomeBot

Copy link
Copy Markdown

Packaging results:

Result Artifact Platform Build Time
PASS RPM EL (EL8/9/10) 34 min
PASS DEB Ubuntu, Debian 25 min

Test packages are available at:

@andrijapanicsb

Copy link
Copy Markdown
Contributor Author

@blueorangutan package

@blueorangutan

Copy link
Copy Markdown

@andrijapanicsb a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

@blueorangutan

Copy link
Copy Markdown

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19930

The deprecated changeServiceForVirtualMachine API is synchronous, so the
CloudRuntimeException from the guard reached the generic API handler, and
non-admin owners got "Internal error executing command" instead of the
reason. Throw InvalidParameterValueException instead: the API shows its
message to every caller. The guard still runs at the same place, before
any change, and internal cluster scaling is not affected.
@andrijapanicsb

Copy link
Copy Markdown
Contributor Author

@ACSHomeBot package

@ACSHomeBot

ACSHomeBot commented Nov 7, 2026 •

Copy link
Copy Markdown

Accepted: package kvm for a263ee2f41d2.

Planned: RPM + DEB, KVM SystemVM.

Status: Failed.

Packaging results:

Result Artifact Platform Build Time
UNKNOWN RPM EL (EL8/9/10) n/a
UNKNOWN DEB Ubuntu, Debian n/a

No public repository was promoted.

Status: Package building failed.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CKS: a single Kubernetes node can be scaled from the Instances view, leaving the cluster inconsistent

3 participants