Repository navigation
Conversation
Contributor
Windows Unit Test Results 3 files 18 suites 1m 1s ⏱️ Results for commit 06378aa. |
Contributor
|
Contributor
|
Contributor
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Adds the node side of NPD binary updates through generic live patching. The AKS resource provider now publishes an
npdBinarycomponent (npd-binary-package-versions), separate fromnpdConfig; until this PR, nodes ignored it. Follows #9725, which baked both NPD packages and addednpdConfigupdates.Separate component
npdBinaryupdates onlynode-problem-detector-kubernetes;npdConfigupdates onlynode-problem-detector-aks-config. Both generic dispatchers (Ubuntu and Azure Linux 3) route them separately, so each gets its own checkpoint, status and events (AKS.LivePatching.npdBinary.*).npd-update.shruns one shared transaction per component (forward-only selection, download, validation, durable marker, held install, restart, health check, rollback to the cached prior package, interrupted-transaction recovery). Each component uses its own package, marker (pendingvspending-binary) and cached rollback package. The existing config tests pass unchanged.npdConfig, e.g.{"ubuntuPackageVersions":{"24.04":"0.8.25-ubuntu24.04u24"},"azureLinuxPackageVersions":{"3.0":"0.8.25-24.azl3"}}. Every release has its own binary build, so the 26.04→24.04 config mapping does not apply to the binary.Binary-specific checks
node-problem-detector --versionmust run on the node./healthzalone can pass while every apiserver call fails (as seen with the ML-KEM/OpenSSL issue fixed in the VM extension). The handler also requires NPD to refresh its node condition heartbeat (KernelDeadlockorReadonlyFilesystem) after the restart, otherwise it rolls back. Rollback only requires local health, so an apiserver outage can't block recovery.VHD
/opt/node-problem-detector/downloadsfor offline rollback; the content test checks both cached packages and holds.Validation
npd-binary-integration.shwith real published packages and the real package manager, passed on Ubuntu 24.04 (u23→u24) and Azure Linux 3 (23.azl3→24.azl3): no-op, real held upgrade from PMC (through the tdnf lock bypass on Azure Linux), interrupted recovery, and rollback when NPD stops reporting. Only the restart and the reporting check are stubbed.verify_shell.shandgo test ./pkg/agent/...pass.Not yet validated: the heartbeat check on a real node (that NPD refreshes
lastHeartbeatTimepromptly after a restart). I'll validate on a PR-built VHD before asking for merge.Which issue(s) this PR fixes:
Fixes #