Skip to content

Conversation

@fiunchinho
Copy link
Contributor

@fiunchinho fiunchinho commented Nov 17, 2025

What type of PR is this?

/kind bug

What this PR does / why we need it:

While reconciling newly created AWSMachines, I noticed that this error usually happens

admission webhook \"validation.awsmachine.infrastructure.cluster.x-k8s.io\" denied the request: AWSMachine.infrastructure.cluster.x-k8s.io \"mycluster-somemachine\" is invalid: spec: Forbidden: cannot be modified" controller="awsmachine" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSMachine" AWSMachine="default/mycluster-somemachine" namespace="default" name="mycluster-mymachine" reconcileID="92584f4e-6f44-4f12-8007-352eab8a1429"

The problem is that we are setting the defaults on the existing AWSMachine while reconciling it. I think it'd be better to use the defaulting admission controller instead, and avoid default during the reconciliation.

Checklist:

  • squashed commits
  • includes documentation
  • includes emoji in title
  • adds unit tests
  • adds or updates e2e tests

Release note:

Default AWSMachine in admission controller instead of during reconciliation

@k8s-ci-robot
Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 17, 2025
@k8s-ci-robot k8s-ci-robot requested a review from damdo November 17, 2025 15:29
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Nov 17, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign justinsb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added needs-priority size/L Denotes a PR that changes 100-499 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 17, 2025
@fiunchinho fiunchinho changed the title Default AWSMachine in admission controller 🐛 Default AWSMachine in admission controller instead of during reconciliation Nov 17, 2025
@fiunchinho fiunchinho marked this pull request as ready for review November 17, 2025 17:06
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 17, 2025
@fiunchinho
Copy link
Contributor Author

/test all

@fiunchinho
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e-blocking

@fiunchinho fiunchinho moved this to Blocked / Waiting ⛔️ in Roadmap Nov 18, 2025
@fiunchinho
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e

@AndiDog
Copy link
Contributor

AndiDog commented Nov 18, 2025

/test pull-cluster-api-provider-aws-e2e-blocking

Comment on lines 1321 to 1322
// If InstanceMetadataOptions is not set in the spec, don't modify the instance
// The webhook will set defaults on new resources, but we shouldn't force defaults on existing instances
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// If InstanceMetadataOptions is not set in the spec, don't modify the instance
// The webhook will set defaults on new resources, but we shouldn't force defaults on existing instances
// If InstanceMetadataOptions is not set in the spec, don't modify the AWSMachine.
// The webhook will set defaults on new AWSMachines, but we cannot write defaults to existing objects
// because validation doesn't allow changes to the spec.

Attribute: ec2types.NetworkInterfaceAttributeGroupSet,
})).Return(&ec2.DescribeNetworkInterfaceAttributeOutput{Groups: []ec2types.GroupIdentifier{{GroupId: aws.String("3")}}}, nil).MaxTimes(1)
m.ModifyNetworkInterfaceAttribute(context.TODO(), gomock.Any()).AnyTimes()
m.ModifyInstanceMetadataOptions(context.TODO(), gomock.Any()).MaxTimes(1)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's IMO not expected while creating an instance. The metadata should be set once in RunInstances, and not modified afterwards.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you're right. I gave it another shot, I completely removed ModifyInstanceMetadataOptions now, and rely only on the admission controller to change the metadata options.

@fiunchinho
Copy link
Contributor Author

/test all

@fiunchinho
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e

1 similar comment
@fiunchinho
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e

@fiunchinho fiunchinho requested a review from AndiDog November 19, 2025 08:45
@k8s-ci-robot
Copy link
Contributor

@fiunchinho: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-cluster-api-provider-aws-e2e 7f241e1 link false /test pull-cluster-api-provider-aws-e2e

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-priority release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants