From 3491077c4179cf4c738ba368ada7bba3826cd781 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 8 Oct 2026 21:34:36 +0200 Subject: [PATCH] fix(deploy): ask a full worker for the smallest request the credential probe can make The runtime pull probe names its node, so the kubelet alone admits it. With a 16Mi memory request it was refused (OutOfmemory) by a worker that had 15 Mi left to request, the drain was refused, and the production deploy failed; the recovery deploy of main failed the same way on another worker. The probe only prints a version, so it now requests 1m CPU and 1Mi memory and keeps its limits. The fake kubectl rejects a probe that asks for more, so every probe test holds the manifest to that. Fixes #4664 Co-Authored-By: Claude Opus 5.5 --- scripts/refresh-flux-ghcr-auth.sh | 6 +++++- scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go | 8 ++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/scripts/refresh-flux-ghcr-auth.sh b/scripts/refresh-flux-ghcr-auth.sh index 50773f1e46..1e97660e94 100755 --- a/scripts/refresh-flux-ghcr-auth.sh +++ b/scripts/refresh-flux-ghcr-auth.sh @@ -1716,7 +1716,11 @@ probe_node_runtime_pull() { imagePullPolicy: "Always", args: ["--version"], resources: { - requests: {cpu: "10m", memory: "16Mi"}, + # The Pod names its node, so the kubelet alone admits it, and it refuses a Pod + # that asks for more memory than the node has left to request (#4664: a + # worker with 15 Mi left refused 16 Mi and stopped the deploy). The probe + # only prints a version, so it asks for the least the node can grant. + requests: {cpu: "1m", memory: "1Mi"}, limits: {cpu: "100m", memory: "64Mi"} }, securityContext: { diff --git a/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go b/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go index 8ff5b3599f..91a9a18e67 100644 --- a/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go +++ b/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go @@ -3007,6 +3007,14 @@ func fakeKubectlCreateRuntimeProbe(namespace, manifestFile string) int { container["imagePullPolicy"] != "Always" || securityContext["allowPrivilegeEscalation"] != false { return commandFailure(91, "runtime probe does not prove a private package pull") } + // The probe names its node, so the kubelet alone admits it, and refuses it when the node has + // less memory left to request than the probe asks for (#4664). The smallest request the + // namespace accepts keeps that refusal to a node with nothing left at all. + resources, _ := container["resources"].(map[string]any) + requests, _ := resources["requests"].(map[string]any) + if requests["memory"] != "1Mi" || requests["cpu"] != "1m" { + return commandFailure(91, "runtime probe asks its node for more than the minimum request") + } probeName, _ := metadata["name"].(string) probeNode, _ := spec["nodeName"].(string) if probeName == "" || probeNode == "" {