fix(kernel-deploy): make mkagent fail loudly instead of returning no pod name #2033

Merged

sean merged 1 commit from fix/mkagent-empty-pod-name into trunk

2026-08-11 16:53:39 +00:00

sean commented

2026-08-11 16:53:16 +00:00

Owner

This is the open defect blocking the 6.18.44 CVE roll.

mkagent piped straight into kubectl create -f - -o name. A rejected create wrote its reason to stderr and printed nothing on stdout, so the caller held pod="" and every later get pod "" failed into 2>/dev/null. phase then stayed EMPTY for the whole budget — which reads as the agent never starts, when the truth is the pod was never created.

The final-verify copy had the same bug and never received the --request-timeout fix from #2031. It now carries both, plus the explicit TIMED OUT message.

Proof (stubbed kubectl, against the extracted scripts)

case	before	after
create refused	12s of a 12s budget, `agent (kpre)` empty name, `phase=unknown`	0s, reports the servers own message
create succeeds	rc=0	rc=0, unchanged

bash -n clean on both scripts; YAML parses.

This is the open defect blocking the 6.18.44 CVE roll. `mkagent` piped straight into `kubectl create -f - -o name`. A rejected create wrote its reason to **stderr** and printed nothing on stdout, so the caller held `pod=""` and every later `get pod ""` failed into `2>/dev/null`. `phase` then stayed EMPTY for the whole budget — which reads as *the agent never starts*, when the truth is *the pod was never created*. The `final-verify` copy had the same bug **and** never received the `--request-timeout` fix from #2031. It now carries both, plus the explicit TIMED OUT message. ### Proof (stubbed kubectl, against the extracted scripts) | case | before | after | |---|---|---| | create refused | 12s of a 12s budget, `agent (kpre)` empty name, `phase=unknown` | **0s**, reports the servers own message | | create succeeds | rc=0 | rc=0, unchanged | `bash -n` clean on both scripts; YAML parses.

sean added 1 commit

2026-08-11 16:53:16 +00:00

fix(kernel-deploy): make mkagent fail loudly instead of returning no pod name

pipeline/ci CI green @ 1ad5533ef1b0

Details

1ad5533ef1

`mkagent` piped straight into `kubectl create -f - -o name`. A rejected
create wrote its reason to stderr and printed NOTHING on stdout. The
caller then held `pod=""`, and every later `get pod ""` failed into
`2>/dev/null`. So `phase` stayed EMPTY for the whole budget.

That is the open defect behind every 6.18.44 roll failure. It reads as
"the agent never starts", but the truth is "the pod was never created".
The reason was already on stderr, disconnected from the failure it caused.

mkagent now captures stderr, reports the server's own message, and never
returns an empty name. Both callers fail immediately if the name is empty.

The final-verify copy had the SAME bug, and it never got the
`--request-timeout` fix from #2031 either. It now carries both, plus the
explicit TIMED OUT message that roll-node already had.

Proven with a stubbed kubectl, on the extracted scripts:

  old, create refused: 12s of a 12s budget, `agent  (kpre)` with an empty
                       name, phase=unknown   <- the live symptom
  new, create refused: 0s, "could not create the kpre agent pod on
                       worker-test: Error from server (Forbidden): ..."
  new, create ok:      unchanged, rc=0

`bash -n` is clean on both scripts and the YAML parses.

sean merged commit 1ad5533ef1 into trunk

2026-08-11 16:53:39 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2033

No description provided.

Rows
Columns