From 488c2a301444d0d919d14e7339d21dd13948075a Mon Sep 17 00:00:00 2001 From: David Joshy Date: Thu, 6 Aug 2026 13:32:30 -0400 Subject: [PATCH] vsphere: check secret before mutating template --- pkg/controller/bootimage/vsphere_helpers.go | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/pkg/controller/bootimage/vsphere_helpers.go b/pkg/controller/bootimage/vsphere_helpers.go index fd8d36342f..023f80db0d 100644 --- a/pkg/controller/bootimage/vsphere_helpers.go +++ b/pkg/controller/bootimage/vsphere_helpers.go @@ -362,6 +362,12 @@ func resolveExistingTemplateVM( if len(computedName) > 80 { return nil, "", false, fmt.Errorf("length of VM template name `%s` exceeds the permitted limit of 80 characters", computedName) } + // Validate/upgrade the ignition stub before creating the template in vSphere. If this fails, + // we must not have already mutated vSphere state, or a subsequent reconcile would find the + // template already in place and silently drop the error (see reconcileVSphereProviderSpec). + if err := upgradeStubIgnitionIfRequired(providerSpec.UserDataSecret.Name, kubeClient); err != nil { + return nil, "", false, err + } ova, ovaErr := streamData.QueryDisk(arch, "vmware", "ova") if ovaErr != nil { return nil, "", false, ovaErr @@ -383,6 +389,11 @@ func resolveExistingTemplateVM( } // Rollback: restore the old template renamed away during a crashed atomic swap. + // Validate/upgrade the ignition stub before this rename, so an invalid user-data secret blocks + // even this recovery mutation rather than only the OVA-driven create/swap paths. + if err := upgradeStubIgnitionIfRequired(providerSpec.UserDataSecret.Name, kubeClient); err != nil { + return nil, "", false, err + } klog.Infof("Recovering from mid-swap crash: renaming %s back to %s", oldTempName, computedName) renameTask, renameErr := oldVM.Rename(ctx, computedName) if renameErr != nil { @@ -742,6 +753,14 @@ func createNewVMTemplate(streamData *stream.Stream, providerSpec *machinev1beta1 if templateProductVersion != release { klog.Infof("Existing RHCOS v%s does not match current RHCOS v%s. Starting reconciliation process.", templateProductVersion, release) + // Validate/upgrade the ignition stub before swapping the template in vSphere. If this + // fails, we must not have already mutated vSphere state, or a subsequent reconcile would + // find the template already up to date and silently drop the error (see + // reconcileVSphereProviderSpec). + if err := upgradeStubIgnitionIfRequired(providerSpec.UserDataSecret.Name, kubeClient); err != nil { + return "", false, err + } + // Find and download the relevant OVA file ova, err := streamData.QueryDisk(arch, "vmware", "ova") if err != nil {