🐛 Fix to enable bootstrap secret rotation if the secret itself missing

[bdehri]

What this PR does / why we need it:

When the bootstrap token is expired and the respective secret is already cleaned up, MachinePools cannot be scaled up due to missing token. In order to mitigate this issue, the secret can be rotated if it is missing.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #6029

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: bdehri / name: Berk Dehrioglu (2788a24)

[k8s-ci-robot]

Welcome @bdehri!

It looks like this is your first PR to kubernetes-sigs/cluster-api 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cluster-api has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @bdehri. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[AverageMarcus]

/ok-to-test

[bdehri]

/retest

[fabriziopandini]

Before reviewing the PR I would like to better understand in which case the bootstrap token for a machine poll can expire, given that we are continuously refreshing it.
/cc @CecileRobertMichon

[CecileRobertMichon]

Before reviewing the PR I would like to better understand in which case the bootstrap token for a machine poll can expire, given that we are continuously refreshing it.

I have the same question. Although the fix itself seems relatively harmless, in the worst case it's just dead code that is never reached.

/cc @mboersma

[bdehri]

/test pull-cluster-api-test-main
/test pull-cluster-api-verify-main

[bdehri]

Hello @CecileRobertMichon, @fabriziopandini,

At the moment, cause of the deletion is unknown to us and we could not reproduce the issue in a reliable manner. We found that it happens some time passed after initial deployment. Until we discover the root cause, we wanted to make the code more resilient against such issues.

[CecileRobertMichon]

@bdehri understood. In that case given

the fix itself seems relatively harmless, in the worst case it's just dead code that is never reached

I'm okay with this fix if we add a code comment to explain why we need it

[fabriziopandini]

lgtm pending squash

[sbueringer]

lgtm pending squash

@fabriziopandini Just a quick reminder (to everyone :)). We can now - if we want to - lgtm before the squash and the lgtm label will be preserved.

[CecileRobertMichon]

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 3ea0fd87ab9b2836ab010b3bbf2ee392adb774ca

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: CecileRobertMichon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [CecileRobertMichon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sbueringer]

Seems to fall under "bugs without easy workarounds"

/cherry-pick release-1.3

[sbueringer]

/cherry-pick release-1.2

[k8s-infra-cherrypick-robot]

@sbueringer: new pull request created: #7853

In response to this:

Seems to fall under "bugs without easy workarounds"

/cherry-pick release-1.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-infra-cherrypick-robot]

@sbueringer: new pull request created: #7854

In response to this:

/cherry-pick release-1.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.