From ded74bca7cae0e2a8f7252787fc1a6a68170ae69 Mon Sep 17 00:00:00 2001 From: OpenShift CI Bot Date: Fri, 4 Sep 2026 10:08:45 +0000 Subject: [PATCH 1/2] fix(daemon): verify extension packages during non-boot sync Extension package verification previously only ran during checkStateOnFirstRun at boot time. When the MCD pod was restarted to trigger re-verification, the bind mount on /usr/bin/rpm created in the host's mount namespace was not always visible to the new container, particularly on vSphere where the hostPath recursive bind mount behavior differs from AWS. Add extension verification to the non-boot sync path in syncNode so the running MCD can detect missing extension packages without a pod restart. Also add logic to clear the Degraded state when a previously-degraded node passes extension verification on a subsequent sync. Co-Authored-By: Claude Opus 4.6 --- pkg/daemon/daemon.go | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/pkg/daemon/daemon.go b/pkg/daemon/daemon.go index c75f455e58..ac763e22cf 100644 --- a/pkg/daemon/daemon.go +++ b/pkg/daemon/daemon.go @@ -884,6 +884,25 @@ func (dn *Daemon) syncNode(key string) error { } } else { + if dn.os.IsCoreOSVariant() { + if odc, odcErr := dn.getCurrentConfigOnDisk(); odcErr == nil && odc != nil { + coreOSDaemon := CoreOSDaemon{dn} + if verifyErr := coreOSDaemon.verifyExtensionPackages(odc.currentConfig); verifyErr != nil { + return fmt.Errorf("extension package verification failed: %w", verifyErr) + } + } + } + + if dn.node.Annotations[constants.MachineConfigDaemonStateAnnotationKey] == constants.MachineConfigDaemonStateDegraded { + annos := map[string]string{ + constants.MachineConfigDaemonStateAnnotationKey: constants.MachineConfigDaemonStateDone, + constants.MachineConfigDaemonReasonAnnotationKey: "", + } + if _, setErr := dn.nodeWriter.SetAnnotations(annos); setErr != nil { + klog.Errorf("Failed to clear degraded state after successful sync: %v", setErr) + } + } + err = upgrademonitor.GenerateAndApplyMachineConfigNodes( &upgrademonitor.Condition{State: mcfgv1.MachineConfigNodeUpdated, Reason: string(mcfgv1.MachineConfigNodeUpdated), Message: fmt.Sprintf("Node %s Updated", dn.node.GetName())}, nil, From c5cafda7f5add31c02a6e9dd5b958f12793b3542 Mon Sep 17 00:00:00 2001 From: OpenShift CI Bot Date: Fri, 4 Sep 2026 10:08:52 +0000 Subject: [PATCH 2/2] fix(test): use node annotation instead of MCD pod restart in TC 89095 Replace the MCD pod deletion in TC 89095 with a node annotation change that triggers a re-sync of the running MCD. This avoids the bind mount visibility issue where a new MCD container created after pod deletion may not see the bind mount on /usr/bin/rpm, causing the test to always fail on vSphere. By keeping the original MCD pod running, the HostToContainer mount propagation ensures the bind-mounted fake rpm is visible, and the non-boot sync path added in the companion daemon commit performs extension verification and correctly degrades the node. Co-Authored-By: Claude Opus 4.6 --- test/extended-priv/mco_extensions.go | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/test/extended-priv/mco_extensions.go b/test/extended-priv/mco_extensions.go index 64c8933ef1..ea8d5508ae 100644 --- a/test/extended-priv/mco_extensions.go +++ b/test/extended-priv/mco_extensions.go @@ -225,16 +225,18 @@ var _ = g.Describe("[sig-mco][Suite:openshift/machine-config-operator/longdurati "The MCP should complete the update after installing usbguard extension") logger.Infof("OK!\n") - exutil.By("Re-apply fake rpm after reboot (bind mount is lost on reboot)") + exutil.By("Replace rpm with fake script to simulate missing usbguard package") o.Expect(ReplaceRpm(node, fakeRpmLocalPath)).To(o.Succeed(), - "Failed to re-apply fake rpm on node %s", node.GetName()) + "Failed to replace rpm on node %s", node.GetName()) logger.Infof("OK!\n") - exutil.By("Restart MCD pod on the node to pick up fake rpm") - mcdPod := node.GetMachineConfigDaemon() - err = NewNamespacedResource(oc.AsAdmin(), "pod", MachineConfigNamespace, mcdPod).Delete() - o.Expect(err).NotTo(o.HaveOccurred(), "Failed to delete MCD pod %s", mcdPod) - logger.Infof("Deleted MCD pod %s to trigger re-sync", mcdPod) + exutil.By("Trigger MCD re-sync to detect missing extension package") + _, err = oc.AsAdmin().WithoutNamespace().Run("annotate").Args( + "node", node.GetName(), + fmt.Sprintf("test.openshift.io/trigger-sync=%s", testID), + "--overwrite", + ).Output() + o.Expect(err).NotTo(o.HaveOccurred(), "Failed to annotate node %s to trigger re-sync", node.GetName()) logger.Infof("OK!\n") exutil.By("Wait for MCP to degrade with extension verification error")