🌱 re-read hardwareDetails

[guettli]

Always refresh HardwareDetails in actionRegistering instead of only setting it when nil. This means hardware changes (e.g. NIC replacement → new IP) are picked up automatically on re-registration without manual intervention.

When the refreshed details differ from the previously stored ones, the controller logs a "HardwareDetails changed" message with old and new values.

Fixes #1789

Related: #2095

[janiskemper]

can you explain how this fixes the issues?

[guettli]

can you explain how this fixes the issues?

Before the HardwareDetails got only set, when they were nil:

if s.scope.HetznerBareMetalHost.Spec.Status.HardwareDetails == nil

Now they get set always. This means, if the HardwareDetails were outdated, they get updated.

[janiskemper]

how is that related to the vswitch issue?

[guettli]

@janiskemper

how is that related to the vswitch issue?

I suggest to update HardwareDetails to include the vSwitch IP. Otherwise the security check is useless: When we allow the sender to include data to a list, which gets used by the receiver to check the data of the sender, then this is loop. Caph must read the data from somewhere else, not from CSR/Node.

[janiskemper]

use an event here as well, otherwise you wouldn't be able to see this on the object-level

[ashish1099]

we can either query vswitch api to get the details before populating the hardwaredetails (with internal ips) <- I havent did this but I think it should be doable.

or we simply reconcile to whatever node.status.address reports

[guettli]

or we simply reconcile to whatever node.status.address reports

@ashish1099

or we simply reconcile to whatever node.status.address reports

The task of the CSR is to check if the node can be trusted. When the node provides the IP list, which CSR will use to validate the node, then we do no need to make this check at all. I am open to discuss if we should drop the IP check completely.

But checking input, which uses a list given by the input, makes no sense. Or I am missing something, then please correct me!

[guettli]

we can either query vswitch api to get the details before populating the hardwaredetails (with internal ips) <- I havent did this but I think it should be doable.

@ashish1099 Can you provide a PR?

[ashish1099]

we can either query vswitch api to get the details before populating the hardwaredetails (with internal ips) <- I havent did this but I think it should be doable.

@ashish1099 Can you provide a PR?

https://github.com/Obmondo/cluster-api-provider-hetzner/pull/4/changes

I did a quick patch here.

the problem is on hetzner you can only setup the vswitch in the post/prekubeadmin stage and by then hardware details is given already, so we would never get those internal IP (if you are on vswithc)

I was tempted to use the vswitch api query but then appending the node spec just make it easy if there are more IPs

[guettli]

we can either query vswitch api to get the details before populating the hardwaredetails (with internal ips) <- I havent did this but I think it should be doable.

@ashish1099 Can you provide a PR?

https://github.com/Obmondo/cluster-api-provider-hetzner/pull/4/changes

I did a quick patch here.

the problem is on hetzner you can only setup the vswitch in the post/prekubeadmin stage and by then hardware details is given already, so we would never get those internal IP (if you are on vswithc)

I was tempted to use the vswitch api query but then appending the node spec just make it easy if there are more IPs

@ashish1099 have you understood why I don't want to read the node object, to validate the node object? If not, please try to undestand that first. Of course, this is easier. But if we would do that, then checking the IP makes no sense.

[ashish1099]

@ashish1099 have you understood why I don't want to read the node object, to validate the node object? If not, please try to undestand that first. Of course, this is easier. But if we would do that, then checking the IP makes no sense.

That make sense, so vswitch api query seems to be a correct way to me