fix: drift nodes on node class edits the server cannot show, cut 0.8.0 #26

Open

mikluko wants to merge 11 commits from mikluko/nodeclass-hash into main

pull from: mikluko/nodeclass-hash

merge into: mikluko:main

mikluko:main

mikluko:mikluko/forge-migration

mikluko:price-metric

mikluko:renovate/sigs.k8s.io-controller-tools-0.x

mikluko:mikluko/bootstrap-split

mikluko:mikluko/secret-watch-lease

mikluko:mikluko/optional-network

mikluko:mikluko/karpenter-1.15

mikluko:mikluko/go-1.27.2

mikluko:release/v0.2.0

mikluko:mikluko/one-app

mikluko:mikluko/release-cut-roll

mikluko:mikluko/release-from-changelog

Conversation 0 Commits 11 Files changed 49 +1252 -459

mikluko commented 2026-10-27 22:14:14 +00:00

Owner

Copy link

Bootstrap, image selector, SSH keys, public IPs and placement group
strategy cannot be read back from a running server, so they are compared
by hash instead, after the AWS provider: each NodeClaim is stamped at
launch with the hash of its node class, and a mismatch drifts it as
NodeClassDrift. Fields drift already checks against the server, and
kubelet, which changes no server, are left out of the hash.

NodeClaims with no hash, or one under another hash version, are stamped
with the node class as it stands rather than drifted, so an upgrade does
not replace every node. Nodes already behind a node class edit when this
lands still have to be replaced by hand.

Closes #24

Stacked on #25; merge that first. 0.8.0 carries both.

Bootstrap, image selector, SSH keys, public IPs and placement group strategy cannot be read back from a running server, so they are compared by hash instead, after the AWS provider: each NodeClaim is stamped at launch with the hash of its node class, and a mismatch drifts it as NodeClassDrift. Fields drift already checks against the server, and kubelet, which changes no server, are left out of the hash. NodeClaims with no hash, or one under another hash version, are stamped with the node class as it stands rather than drifted, so an upgrade does not replace every node. Nodes already behind a node class edit when this lands still have to be replaced by hand. Closes #24 Stacked on #25; merge that first. 0.8.0 carries both.

mikluko added 4 commits 2026-10-27 22:14:15 +00:00

feat!: move the project to forge.sarak.sh ... dbda1257ef

The module path becomes sarak.sh/mikluko/karpenter-provider-hetzner,
which sarak.sh already serves as a go-import. CI and releases run on
Forgejo Actions and publish to the sarak.sh registry, following
arr/sniffarr: REGISTRY_TOKEN logs in as agent, RELEASE_TOKEN pushes the
tag so release-roll starts.

Cosign signing is dropped: keyless signing needs an OIDC token that
Forgejo Actions does not issue. The upgrade agent is dropped with the
GitHub App and gh stack it is built on. Security reports go to
security@sarak.sh, as Forgejo has no private advisories.

docs: drop the code of conduct's enforcement section fd75d0536d

docs: drop the code of conduct 0f72c7f763

fix: drift nodes on node class edits the server cannot show, cut 0.8.0 ... 2c451b19bb

Bootstrap, image selector, SSH keys, public IPs and placement group
strategy cannot be read back from a running server, so they are compared
by hash instead, after the AWS provider: each NodeClaim is stamped at
launch with the hash of its node class, and a mismatch drifts it as
NodeClassDrift. Fields drift already checks against the server, and
kubelet, which changes no server, are left out of the hash.

NodeClaims with no hash, or one under another hash version, are stamped
with the node class as it stands rather than drifted, so an upgrade does
not replace every node. Nodes already behind a node class edit when this
lands still have to be replaced by hand.

Closes #24

mikluko force-pushed mikluko/nodeclass-hash from 2c451b19bb to f290258622 2026-10-27 22:16:43 +00:00 Compare

mikluko force-pushed mikluko/nodeclass-hash from f290258622 to 3623018f3b 2026-10-27 22:18:58 +00:00 Compare

mikluko force-pushed mikluko/nodeclass-hash from 3623018f3b to 74c5b25540 2026-10-27 22:21:46 +00:00 Compare

mikluko force-pushed mikluko/nodeclass-hash from 74c5b25540 to bf98fde198 2026-10-27 22:25:54 +00:00 Compare

mikluko force-pushed mikluko/nodeclass-hash from bf98fde198 to 1b5dba4593 2026-10-27 22:31:33 +00:00 Compare

mikluko force-pushed mikluko/nodeclass-hash from 1b5dba4593 to 51f3a1917a 2026-10-27 22:33:19 +00:00 Compare

mikluko force-pushed mikluko/nodeclass-hash from 51f3a1917a to 84c153695f 2026-10-27 22:49:14 +00:00 Compare

mikluko added a new dependency 2026-10-27 22:54:29 +00:00

#25 feat!: move the project to forge.sarak.sh

All checks were successful

Hide checks

Security / govulncheck (shipped toolchain) (pull_request) Has been skipped

Details

CI / lint (pull_request) Successful in 5m32s

Details

CI / chart (pull_request) Successful in 14s

Details

CI / changelog (pull_request) Successful in 10s

Details

Security / govulncheck (pull_request) Successful in 2m51s

Details

CI / generate (pull_request) Successful in 7m46s

Details

CI / test (pull_request) Successful in 16m58s

Details

CI / controllers (pull_request) Successful in 9m41s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin mikluko/nodeclass-hash:mikluko/nodeclass-hash

git switch mikluko/nodeclass-hash

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff mikluko/nodeclass-hash

git switch mikluko/nodeclass-hash

git rebase main

git switch main

git merge --ff-only mikluko/nodeclass-hash

git switch mikluko/nodeclass-hash

git rebase main

git switch main

git merge --no-ff mikluko/nodeclass-hash

git switch main

git merge --squash mikluko/nodeclass-hash

git switch main

git merge --ff-only mikluko/nodeclass-hash

git switch main

git merge mikluko/nodeclass-hash

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

accessibility

Barrier affecting people with disabilities

  

bot

  

bug

Something isn't working

  

dependencies

Pull requests that update a dependency file

  

docker

Pull requests that update docker code

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

go

Pull requests that update go code

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

accessibility

bot

bug

dependencies

docker

documentation

duplicate

enhancement

go

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Depends on

#25 feat!: move the project to forge.sarak.sh

mikluko/karpenter-provider-hetzner

Reference

mikluko/karpenter-provider-hetzner!26

No description provided.