Upgrade Kubernetes to 1.35.7 and bump pinned GitHub Actions - #56
Merged
Merged
Conversation
1.34's community support ends Nov 2026 and 1.35 is the current AKS default in West US 2, supported through Mar 2027. Checked support status with `az aks get-versions --location westus2`: 1.34, 1.35 and 1.36 all list `KubernetesOfficial`, so this cluster (Free tier, `supportPlan: KubernetesOfficial`) stays in official support either way. Going to 1.35 rather than 1.36 because AKS only allows one minor per upgrade -- 1.36 is a follow-up PR once this applies. Bumps the control plane to the exact patch and the node pool's orchestrator_version to the minor, which resolves to the latest patch -- matching how 1.31 through 1.34 were pinned. This upgrade also reimages the nodes from Ubuntu 22.04 to 24.04. The pool leaves os_sku unset, i.e. the generic "Ubuntu" SKU, and AKS resolves that to 22.04 on 1.25-1.34 and to 24.04 on 1.35+. That is wanted: Ubuntu 22.04 on AKS stops receiving security patches 2027-06-30, so this rides the OS migration in on an upgrade we need anyway. Note this corrects 8963a01, which said AKS defaults to 24.04 at 1.36; the cutover is 1.35. Pre-flight checks against the live cluster: - Upstream lists no GA API removals for 1.35. - `apiserver_requested_deprecated_apis` has one counter, core/v1 endpoints, with `removed_release=""` -- deprecated in favour of EndpointSlice but not scheduled for removal, so nothing breaks. - All 11 FlowSchemas are on flowcontrol.apiserver.k8s.io/v1. - No gitRepo volumes anywhere. - cgroup v1 support is removed in 1.35 (KEP-5573). Nodes are already cgroup v2: AKS Ubuntu 22.04 images default to the unified hierarchy, kubelet reports `cgroupDriver: systemd`, and no cgroup-v1 revert DaemonSet is installed. The 24.04 reimage is cgroup v2 regardless. - kube-proxy ipvs mode is deprecated in 1.35. This cluster runs iptables mode (confirmed in kube-proxy logs), so it is unaffected. `tofu plan` could not be run locally: the state backend's listKeys call is returning 403 "request is blocked" (Azure throttling), and Entra ID backend auth fails because the account lacks a Storage Blob Data role on the state account. CI runs plan with ARM_ACCESS_KEY, which does not call listKeys, so the plan on this PR is the one to review. Expect 1 change, 0 to add, 0 to destroy -- an in-place update, so temporary_name_for_rotation is not triggered. max_surge=1 with the API default max_unavailable=0 keeps 2 nodes schedulable throughout, though the 22.04 -> 24.04 reimage means every node is replaced this time rather than upgraded in place. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KM1NqDHdgi8odqATVTd4ad
All four pinned actions were behind. SHAs resolved from the release tags: - actions/checkout v6.0.2 -> v7.0.1 (both workflows) - actions/cache v5.0.5 -> v6.1.0 - opentofu/setup-opentofu v2.0.0 -> v2.0.2 - azure/login v3.0.0 -> v3.0.2 actions/github-script is already on the latest, v9.0.0. checkout v7 and cache v6 are major bumps, but both are ESM migrations plus dependency updates. checkout v7's only behavioural change blocks checking out fork PRs under `pull_request_target` and `workflow_run`; neither workflow here uses those triggers -- opentofu.yml is `push`/`pull_request` and tag-pvc-disks.yml is `schedule`/ `workflow_dispatch` -- so it does not apply. Also fixes the zizmor findings in opentofu.yml, which pre-date this change (verified: the files at b4f3d8e report the same 23 findings, 1 low / 1 medium / 2 high) but block committing the file: - artipacked: the checkout now sets `persist-credentials: false`. Nothing in this workflow pushes with git; the PR comment goes through github-script with an explicit token. - template-injection: `steps.plan.outputs.{stdout,stderr}` and the nine expansions inside the github-script `script:` input now arrive through `env:` and are read via `process.env`. The comment body is assembled from an array joined on newlines rather than one long escaped string, so the markdown no longer depends on YAML quoting. Passing the plan through the environment also fixes a latent bug: the old `echo "${{ steps.plan.outputs.stdout }}"` let backticks and quotes in plan output be interpreted by the shell. Verified the rendered comment is byte-identical to the old one by running both scripts under node with the same substitutions, including a plan containing backticks, double and single quotes, and `$`. zizmor now reports no findings on either workflow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KM1NqDHdgi8odqATVTd4ad
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
OpenTofu Format and Style
|
Contributor
OpenTofu Format and Style
|
3uzbcqje
changed the title
3uzbcqje
force-pushed
the
upgrade-kubernetes-1.35-and-actions
branch
6 times, most recently
from
September 3, 2026 23:29
01ec887 to
615e2f6
Compare
3uzbcqje
changed the title
Contributor
OpenTofu Format and Style
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything in the repo that was behind upstream. Two commits, reviewable separately.
Kubernetes 1.34.10 -> 1.35.7
1.34's community support ends Nov 2026; 1.35 is the current AKS default in West US 2 and is supported through Mar 2027.
az aks get-versions --location westus2lists 1.34, 1.35 and 1.36 all asKubernetesOfficial, so this cluster (Free tier,supportPlan: KubernetesOfficial) stays in official support either way.Only 1.35 here, not 1.36 — AKS allows one minor per upgrade, so 1.36 needs a follow-up PR once this applies.
This also reimages the nodes from Ubuntu 22.04 to 24.04, because the pool leaves
os_skuunset (the genericUbuntuSKU) and AKS resolves that to 22.04 on 1.25–1.34 and 24.04 on 1.35+. That's wanted — Ubuntu 22.04 on AKS stops getting security patches 2027-06-30 — so the OS migration rides in on an upgrade we need anyway. Note this corrects 8963a01, which said the cutover was 1.36; it's 1.35.The reimage happens through AKS's normal surge upgrade, not a Terraform pool rotation:
os_skuisn't in azurerm'scycleNodePoolProperties, and since it stays unset there's noos_skudiff for Terraform to act on.orchestrator_versionisn't in that list either, so this is an in-place update andtemporary_name_for_rotationis not triggered.max_surge = 1with the API defaultmax_unavailable = 0keeps 2 nodes schedulable throughout, though nodes are replaced rather than upgraded in place this time because of the OS change.Pre-flight checks against the live cluster
apiserver_requested_deprecated_apishas one counter, core/v1endpoints, withremoved_release=""— deprecated in favour of EndpointSlice but not scheduled for removal.flowcontrol.apiserver.k8s.io/v1.gitRepovolumes anywhere.cgroupDriver: systemd, and no cgroup-v1 revert DaemonSet is installed. The 24.04 reimage is cgroup v2 regardless.topology.disk.csi.azure.com/zoneis""), so they reattach anywhere in the region.tag-pvc-disks.shdiscovers disks bypvc-name prefix in the node resource group, which doesn't change across the upgrade.Action pins
actions/checkout(both workflows)actions/cacheopentofu/setup-opentofuazure/loginactions/github-scriptis already latest at v9.0.0. checkout v7 and cache v6 are major bumps but both are ESM migrations plus dependency updates; checkout v7's only behavioural change blocks fork-PR checkout underpull_request_target/workflow_run, and neither workflow uses those triggers.That commit also fixes the zizmor findings in
opentofu.yml. These pre-date this PR — the files at b4f3d8e report the same 23 findings (1 low / 1 medium / 2 high) — but they block committing the file, so they're fixed here rather than worked around: the checkout setspersist-credentials: false, and the plan output plus the nine expansions in thegithub-scriptinput now arrive throughenv:and are read viaprocess.env. The comment body is built from an array joined on newlines instead of one long escaped string.That also fixes a latent bug: the old
echo "${{ steps.plan.outputs.stdout }}"let backticks and quotes in plan output be interpreted by the shell.Verification
tofu fmt -check,tofu validate,tflint,zizmor,actionlint, yamllint — all pass (full pre-commit suite).$.tofu planwas not run locally. The state backend'slistKeyscall returns 403 "request is blocked" (Azure throttling), and Entra ID backend auth fails because the account lacks a Storage Blob Data role on the state account. CI runs plan withARM_ACCESS_KEY, which doesn't calllistKeys— so the plan on this PR is the one to review. Expect 1 to change, 0 to add, 0 to destroy. If awtfazuretemp pool shows up in the plan, something is triggering a pool rotation — stop and reassess.🤖 Generated with Claude Code
https://claude.ai/code/session_01KM1NqDHdgi8odqATVTd4ad