Skip to content

✨ Release 1.1 (DO NOT MERGE)#2122

Open
guettli wants to merge 40 commits into
release-1.1-basefrom
release-1.1
Open

✨ Release 1.1 (DO NOT MERGE)#2122
guettli wants to merge 40 commits into
release-1.1-basefrom
release-1.1

Conversation

@guettli

@guettli guettli commented Jun 25, 2026

Copy link
Copy Markdown
Collaborator

Just for Overview, and CI (e2e)

DO NOT MERGE.

Waiting for


PRs merging to branch release-1.1


Conflicts to main can be ignored. We won't merge this to main.

Dhairya-Arora01 and others added 30 commits May 29, 2026 14:24
…ation… (#2048)

🌱 Break the loop to increment condition's observedGeneration (#2046)

* break the loop to increment condition's observedGeneration

HetznerBareMetalHost stores its conditions inside Spec (not in a status subresource).
The CAPI conditions library always sets ObservedGeneration = metadata.generation when
writing a condition. Because the conditions are part of the spec, writing them bumps
metadata.generation, which makes ObservedGeneration stale on the very next reconcile,
which triggers another write, which bumps generation again, this is a loop that
increments metadata.generation on every reconcile loop.
To break the loop: if a condition's Status, Reason, and Message are unchanged from
what is already stored, keep the existing ObservedGeneration instead of overwriting it
with the current (higher) generation. ObservedGeneration will still advance whenever
the condition itself actually changes.



* return a deepcopy of conditions in GetV1Beta2Conditions

---------

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com>
🌱 Remove broken "Sign SBOM Images" step (#2049)

The "Sign SBOM Images" step was failing because it
expected a `.sbom` tag (created by `cosign attach
sbom`), but the workflow uses `cosign attest`,
which stores the SBOM as a referrer manifest — no
`.sbom` tag is ever created. This caused `docker
buildx imagetools inspect` to return nothing,
resulting in the empty-string digest `e3b0c442...`
being signed instead of the actual SBOM.

The step is also redundant: `cosign attest`
already signs the SBOM as part of the attestation
via Sigstore keyless signing.

Also fixes a missing `$` in the image digest echo
line.

Co-authored-by: Thomas Güttler <thomas.guettler@syself.com>
…(COPY of #2098) (#2099)

fix ready HCloudMachine being marked as not existing on rate limit

When GetServer returned a rate-limit error for a ready machine,
handleRateLimit silently returned nil, causing findServer to return
(nil, nil). The reconcile loop interpreted this as the server having
been deleted and called SetErrorAndRemediate, setting BootState to
ProvisioningFailed and annotating the CAPI machine for remediation.

Fix findServer to return the error directly instead of delegating to
handleRateLimit, which was designed for provisioning-path calls.
The rate-limit is already handled correctly at the reconcile-loop level,
which no-ops for ready machines without setting any error conditions.

Copy of: #2098

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com>
🌱 Emit events when HBMH provisioning fails (#2101)

* emit events when HBMH provisioning fails

Ensure that we emit events whenever HBMH provisioning fails.



* fixup! emit events when HBMH provisioning fails

---------

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com>
… LB attach (#2107)

* fix stale HetznerCluster.Status causing cp targets to be skipped on LB attach

reconcileLoadBalancerAttachment in both HCloudMachine and
HetznerBareMetalMachine services checks HetznerCluster.Status to
decide whether a machine is already a load-balancer target. That
status is only updated when the HetznerCluster controller reconciles,
independently of the machine controllers. During a rollout this can
produce a false positive: a target is removed from the LB and then
re-added with the same IP/server-ID, but the stale status still shows
it as present, so the attachment step is skipped and the control-plane
node is never actually added back to the LB.

fixes done:

In both `reconcileLoadBalancerAttachment` implementations, check whether `ServerAvailableCondition`
is already `True` on the machine:

- False/absent (first time): fetch the live LB state directly from the Hetzner API. This
  guarantees correctness regardless of stale status. Add the target if missing. When the function
  returns nil, `ServerAvailableCondition` gets set to `True` which signals that the target was
  confirmed in the real LB at least once.
- True (steady state): use `HetznerCluster.Status.ControlPlaneLoadBalancer.Target` as the
  cache. No extra API call is needed. If the target has been removed, `HetznerCluster.Status` will
  eventually reflect this (see below), and the add logic will re-run.

This ensures exactly one Hetzner API call for lb per machine lifecycle.

Also, add watches on `HetznerBareMetalMachine` and `HCloudMachine` in the `HetznerCluster` controller's
`SetupWithManager`. Each watch triggers a `HetznerCluster` reconcile when:
- `ServerAvailableCondition` transitions to `True` (machine provisioned, target just added)
- The machine is deleted (target needs to be reflected as removed in status)

This ensures that the `HetznerCluster.Status` is not stale.

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com>

* fixup! fix stale HetznerCluster.Status causing cp targets to be skipped on LB attach

* fixup! fixup! fix stale HetznerCluster.Status causing cp targets to be skipped on LB attach

---------

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com>
)

docs: add hint about k8s version limitations for caph v1.0.x

Signed-off-by: skuethe <56306041+skuethe@users.noreply.github.com># Committing as: thomas.guettler@syself.com
* better condition message when waiting for reboot

Better condition message when waiting for the node to be rebooted i.e.
change its bootID.

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com>

---------

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com># Committing as: thomas.guettler@syself.com
🌱 Update github-actions group

| datasource  | package                | from   | to      |
| ----------- | ---------------------- | ------ | ------- |
| github-tags | actions/cache          | v4.2.3 | v4.3.0  |
| github-tags | actions/checkout       | v4.2.2 | v4.3.1  |
| github-tags | actions/setup-go       | v5.3.0 | v5.6.0  |
| github-tags | docker/metadata-action | v5.7.0 | v5.10.0 |
| github-tags | test-summary/action    | v2.4   | v2.6    |

Co-authored-by: syself-bot[bot] <115953087+syself-bot[bot]@users.noreply.github.com>
Co-authored-by: Thomas Güttler <thomas.guettler@syself.com># Committing as: thomas.guettler@syself.com
🌱 Update Update Golang Dependencies group

| datasource | package                             | from    | to      |
| ---------- | ----------------------------------- | ------- | ------- |
| go         | github.com/guettli/check-conditions | v0.0.20 | v0.0.33 |
| go         | github.com/onsi/ginkgo/v2           | v2.28.1 | v2.28.3 |
| go         | github.com/prometheus/common        | v0.67.4 | v0.67.5 |
| go         | k8s.io/apiextensions-apiserver      | v0.35.4 | v0.35.5 |

Co-authored-by: syself-bot[bot] <115953087+syself-bot[bot]@users.noreply.github.com>
Co-authored-by: Thomas Güttler <thomas.guettler@syself.com># Committing as: thomas.guettler@syself.com
| datasource  | package                      | from    | to      |
| ----------- | ---------------------------- | ------- | ------- |
| github-tags | adrienverge/yamllint         | v1.37.1 | v1.38.0 |
| docker      | docker.io/hadolint/hadolint  | v2.12.0 | v2.14.0 |
| docker      | docker.io/lycheeverse/lychee | 0.23.0  | 0.24.2  |

Co-authored-by: syself-bot[bot] <115953087+syself-bot[bot]@users.noreply.github.com># Committing as: thomas.guettler@syself.com
🌱 Update Github Actions group to 24.11.0

| datasource      | package               | from    | to      |
| --------------- | --------------------- | ------- | ------- |
| github-releases | actions/node-versions | 22.21.1 | 24.11.0 |

Co-authored-by: syself-bot[bot] <115953087+syself-bot[bot]@users.noreply.github.com># Committing as: thomas.guettler@syself.com
| datasource  | package                   | from | to     |
| ----------- | ------------------------- | ---- | ------ |
| github-tags | actions/download-artifact | v7   | v8.0.1 |

Co-authored-by: syself-bot[bot] <115953087+syself-bot[bot]@users.noreply.github.com>
Co-authored-by: Thomas Güttler <thomas.guettler@syself.com># Committing as: thomas.guettler@syself.com
…2064)

The BUILD_IMAGE_TOKEN JWT can be hundreds of chars long. When passed as
an inline env var prefix (TOKEN=val ./script.sh), execa treats the first
space-delimited token as the executable filename, hitting the 255-char
ENAMETOOLONG OS limit. Prefixing with `env` makes `env` the executable
and the long token becomes an argument, which has no filename length limit.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
update golang base of builder image

Update golang base of builder image to trixie. The latest lychee version
requires this update.

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com># Committing as: thomas.guettler@syself.com
clear StillProvisioning condition during deprovisioning

Always clear the ProvisionSucceeded condition during deprovisioning to
avoid a misleading StillProvisioning condition with an empty state when
a permanent error occurred.

Signed-off-by: Dhairya Arora <dhairya.arora@syself.com># Committing as: thomas.guettler@syself.com
…flect the Kubernetes Version (#2072)

* 🌱 k8s deps in go.mod must be updated together.

* wider ignore.

* ignore only explictly, no big glob.

* smaller pr.

* ...# Committing as: thomas.guettler@syself.com
* 🌱 add manual baremetal server recovery workflow

Allows operators to trigger caphcli check-bm-server for a specific
server by name. Uses concurrency group ci-e2e-baremetal-global so it
cannot race with a running e2e test, and always reads the hbmh list
from main so the server config is canonical.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* seedling.

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
…2086)

In the rescue system the tar.gz images no longer exist.

Example:

root@rescue ~ # ls -ltr /root/.oldroot/nfs/images/ | grep noble| grep amd

-rw-r--r-- 1 root root  833  2. Jun 12:00 Ubuntu-2404-noble-amd64-base.tar.zst.sig
-rw-r--r-- 1 root root 1,2G  2. Jun 12:00 Ubuntu-2404-noble-amd64-base.tar.zst
lrwxrwxrwx 1 root root   36  8. Jun 10:51 Ubuntu-noble-latest-amd64-base.tar.zst -> Ubuntu-2404-noble-amd64-base.tar.zst
lrwxrwxrwx 1 root root   36  8. Jun 10:51 Ubuntu-noble-latest-amd64-base.tar.gz -> Ubuntu-2404-noble-amd64-base.tar.zst
T
* 🌱 Better error handling in cloud-init

* do not continue on eror.# Committing as: thomas.guettler@syself.com
* 🌱 Restart setting up `kind` (on network error)

* fix. no change in vendor dir.

* 🌱 pull kind image with retry before creating bootstrap cluster

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix lint: drop else after return

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix lint: nolint gosec G204 for docker pull

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
* 🌱 Move bm-e2e-1716772 to ci-pool to restore E2E CI

bm-e2e-1670788 was put in maintenance mode on 2026-06-08 (#2082),
leaving only one ci-pool host (bm-e2e-1724024) available. The baremetal
E2E test needs two ci-pool hosts (one control-plane + one worker), so
every run has been failing since then.

Moves bm-e2e-1716772 (previously working in Feb 2026) from free-pool to
ci-pool to provide the second required host.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* 🌱 Re-enable bm-e2e-1670788 (take out of maintenance mode)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
test/e2e: fail fast when no bare-metal host is available

When a HetznerBareMetalMachine gets HostAssociateSucceeded=False with
reason NoAvailableHost, the test previously waited the full 20-minute
timeout before failing. The logStatusContinuously goroutine already had
a fast-fail path for permanent host errors; this extends it to also
detect the NoAvailableHost condition on HetznerBareMetalMachines and
fail within ~30 seconds instead of waiting out the timeout.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
* 🌱 disable bm-e2e-1716772 after rescue-mode reboot timeout

Server 1716772 (136.243.69.24) failed CI run 27964284038 with a hardware
reboot into rescue mode timing out after 10 minutes. Setting maintenanceMode:
true to prevent it from being picked up until the hardware is investigated.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* 🌱 document that CI always uses hetznerbaremetalhosts.yaml from main

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
Server 1716772 (136.243.69.24) was disabled in #2118 after a rescue-mode
reboot timeout. Re-enabling it now.


# Committing as: thomas.guettler@syself.com

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
* ✨ Add ignoreCheckDisk field to HetznerBareMetalMachine spec

Adds `ignoreCheckDisk` to HetznerBareMetalMachineSpec (v1beta1 and v1beta2)
so users can skip the CheckDisk step declaratively in the machine object,
without having to manually set the annotation on the HetznerBareMetalHost.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* rename: ignoreCheckDisk → skipCheckDisk for clarity

"Skip" better conveys that the step is not run at all,
whereas "ignore" implies it runs but the result is discarded.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* remove unnecessary nil check for HetznerBareMetalMachine

The scope always initializes it as &infrav1.HetznerBareMetalMachine{}.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* 🌱 Relax imageURLCommand regex to allow syself-provisioner naming

Allow names matching ^[a-z][a-z0-9._-]*$ instead of requiring the
image-url-command- prefix, so that syself-provisioner-amd64-v0.0.1
(installed by the kaas init container) is accepted.

Security: The existing basename and .. checks already prevent path
traversal. The regex only enforces naming convention.

* 🌱 Fix BareMetalMachine tests missed in regex relaxation

The previous commit relaxed imageURLCommand regex to ^[a-z][a-z0-9._-]*$
and updated HCloudMachine tests, but missed the HetznerBareMetalMachine
tests in both v1beta1 and v1beta2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions github-actions Bot added size/L Denotes a PR that changes 200-800 lines, ignoring generated files. area/github Changes made in the github directory area/code Changes made in the code directory area/api Changes made in the api directory labels Jun 25, 2026
@guettli guettli changed the title Release 1.1 (DO NOT MERGE) ✨ Release 1.1 (DO NOT MERGE) Jun 25, 2026
guettli and others added 2 commits June 26, 2026 12:29
Without an explicit ref, actions/checkout defaults to the synthetic merge
commit (PR head merged into base). For PRs from release-1.1 targeting main
the merge commit fails to compile due to intentional v1beta1/v1beta2
structural divergence. Pinning to head.sha runs e2e against the actual
branch code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com
* fix: hasJustRebooted returns true indefinitely when RebootTriggeredAt is nil

When RebootTriggeredAt gets cleared (e.g. via ClearError path from connection
error handling) but ErrorType is still SSHRebootTriggered, hasJustRebooted()
incorrectly returns true forever because hasTimedOut(nil, ...) returns false.

Fix: return false early when RebootTriggeredAt is nil.
Also set RebootTriggeredAt when first detecting SSH timeout in emptyErrorType case
so that escalation timeouts are computed correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* test: hasJustRebooted returns false when RebootTriggeredAt is nil

Without the nil guard added in the fix, hasTimedOut(nil, ...) returns
false, causing hasJustRebooted() to return true indefinitely when a
reboot error type is set but RebootTriggeredAt was never populated.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* remove resetting RebootTriggeredAt. We need to wait  until ssh works correctly.

* add comment and info log.

* fix lint: remove redundant embedded field name in Logger selector

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com># Committing as: thomas.guettler@syself.com
@guettli guettli changed the base branch from main to release-1.1-base June 30, 2026 10:03
@github-actions github-actions Bot added area/templates Changes made in the templates directory area/test Changes made in the test directory labels Jun 30, 2026
guettli and others added 3 commits June 30, 2026 12:26
…2130) (#2131)

* ✨ DeviceStringType field for ImageURLCommand (sda vs WWN) (#2130)

* 🌱 DeviceString to use WWN instead of short device name.

* deviceString for hcloud.

* hcloud, no wwn.

* DeviceStringType: Go type, CEL validation, host.go logic, and test

Rename DeviceString → DeviceStringType field (json: deviceStringType), introduce a
typed DeviceStringType string in both v1beta1 and v1beta2, add a CEL validation rule
restricting values to "", "short", and "wwn", implement the switch in
actionImageInstallingImageURLCommand to pass WWNs directly when DeviceStringType is
"wwn", regenerate CRDs and conversion, add a test for the wwn path, and update docs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add CEL validation for DeviceStringType in v1beta1

Mirrors the same XValidation rule already on the v1beta2 field.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Simplify DeviceStringType: drop 'short', add webhook validation and error guard

- Only two valid values now: "" (default, short name) and "wwn"
- Remove DeviceStringTypeShort constant; keep only DeviceStringTypeWWN
- Update CEL rule to self == '' || self == 'wwn' in both v1beta1 and v1beta2
- Move storage fetch into default branch of switch (skipped for wwn path)
- Return error when DeviceStringType is "wwn" but rootDeviceHints has no WWN
- Add webhook validation: deviceStringType is only valid when imageURLCommand is set
- Add webhook and host tests for new error cases

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Regenerate CRDs after comment update

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* no bash example for splitting on whitespace.

* restore "short"

* ...

* docs.

* add comment about validation of empty wwn.

* added examples for WWN and "short"

* caph -> CAPH

* refactor: use kubebuilder:validation:Enum instead of CEL for DeviceStringType

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: remove infrav1 alias in v1beta1 validation test

Cherry-picked test cases from main used an infrav1 import alias, but
the test file is package v1beta1 (same package), so no alias is needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
) (#2132)

* backport: Enable proxy protocol for control plane load balancer (#2113)

Back-ports PR #2113 to release-1.1. Since release-1.1 has no v1beta2 API
and webhooks live in api/v1beta1/, the changes are adapted accordingly:
- ProxyProtocolForControlPlaneLoadBalancerAnnotation added to api/v1beta1/
- EnableProxyProtocol field added to LoadBalancerSpec (v1beta1)
- AllControlPlaneNodesReadyForProxyProtocol added to ClusterScope using infrav1
- reconcileServices updated to handle proxy protocol enable/migration logic
- Webhook validation prevents disabling proxy protocol once enabled
- CRD manifests updated

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* address PR review: align backport with original PR #2113

- Expand ProxyProtocolForControlPlaneLoadBalancerAnnotation comment to
  match the original PR (migration vs. new-cluster distinction)
- Reorder reconcileServices locals to match original PR structure;
  add comment explaining why ControlPlaneEndpoint needs a nil check
  (it is a pointer in v1beta1, unlike v1beta2)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* fix: regenerate CRD manifests to fix field ordering

enableProxyProtocol was placed after port-range fields instead of in
the correct alphabetical position (after algorithm/enabled). Running
make generate-manifests fixes the ordering.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
guettli and others added 5 commits July 3, 2026 21:35
* fix: report bare metal machine public IP as ExternalIP without CIDR suffix

The NIC IP is scraped from the host via `ip addr show`, which prints
addresses in CIDR notation (e.g. "195.201.11.146/26"). That value was
stored verbatim in infrav1.NIC.IP, whose doc comment promises a bare
IP address. nodeAddresses() also tagged every NIC address as
InternalIP unconditionally, unlike the hcloud path which classifies
public vs. private addresses.

Fixes #2137.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com
# Committing as: thomas.guettler@syself.com

* 🌱 Build PR container image and run e2e for release-1.1 PRs

Mirrors the existing release-1.1-base handling so that PRs targeting
release-1.1 also get a manager image build and e2e run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* Gate ExternalIP behavior behind opt-in annotation on HetznerBareMetalMachine

Make the new IP handling opt-in via capi.syself.com/use-external-ip-for-baremetal
on the HetznerBareMetalMachine, since it changes reported Machine addresses
and consumers may depend on the previous behavior. Without the annotation
(or set to anything other than "true"), the NIC IP is reported verbatim,
including any CIDR suffix, and always classified as InternalIP.

Document the new annotation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* Clarify use-external-ip-for-baremetal annotation default behavior

Note that "false" (or unset) explicitly keeps the old behavior, and
that the current default may change in the future.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* Replace opt-in annotation with UseMatchingIPType spec field (v1beta1 only)

HetznerBareMetalMachine doesn't exist in v1beta2 yet, so only v1beta1 gets
the field. UseMatchingIPType is a *bool (not a plain bool) so that unset
can be distinguished from an explicit false, letting a future API version
default it to true without changing what an explicit false means.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* Remove UseMatchingIPType field; always use matching IP type for new machines

No annotation, no spec field, no configurability. The corrected NIC
address classification (strip CIDR suffix, ExternalIP/InternalIP based
on actual type) is now applied unconditionally for every machine that
has not yet reported an InternalIP/ExternalIP address.

Existing machines are unaffected: once a HetznerBareMetalMachine has
reported such an address, it keeps being computed the old way for the
rest of its lifetime, so upgrading does not silently change the address
type of already-running machines.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

* avoid noise in PR.

* fix

* fix2

* not that much inline comments needed.

* Correct comment: this only affects mgt-cluster status, not workload-cluster CNI

Machine.status.addresses lives only in the management cluster. Workload
cluster Node objects are populated independently (e.g. by
hcloud-cloud-controller-manager), so CNI/Cilium there never reads this
field and is not affected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Committing as: thomas.guettler@syself.com

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
The physical server bm-e2e-1716772 fails to reboot into rescue mode again,
causing a permanent HetznerBareMetalHost error in the baremetal e2e (CI run
28847985206, seen on PR #2151). Set maintenanceMode: true so the pool skips it.

Same failure that #2118 disabled it for; #2120 re-enabled it, but it regressed.
Remaining enabled hosts (1670788, 1724024, 1731561) are enough for the basic
baremetal test, which uses two.
Backport of #2136 (main commit 5fb187f) to release-1.1.

Dropped the api/v1beta2/hcloudmachine_types.go hunk (that package does not
exist on release-1.1) and hand-applied the equivalent v1beta1 + CRD + docs +
service changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/api Changes made in the api directory area/code Changes made in the code directory area/github Changes made in the github directory area/templates Changes made in the templates directory area/test Changes made in the test directory size/L Denotes a PR that changes 200-800 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants