[occm] Include cloudConfigContents in DaemonSet checksum annotation by 234u34k · Pull Request #3080 · kubernetes/cloud-provider-openstack

234u34k · 2026-03-01T16:49:16Z

The DaemonSet checksum annotation only hashes the output of the cloudConfig template helper. When cloud config is supplied via cloudConfigContents, changes to it do not trigger pod restarts. Credential rotations and endpoint changes go undetected.

Include cloudConfigContents in the checksum input.

Ref #3030

occm: Fix DaemonSet checksum annotation to include cloudConfigContents so that config changes trigger pod restarts.

linux-foundation-easycla · 2026-03-01T16:49:23Z

The committers listed above are authorized under a signed CLA.

✅ login: 234u34k / name: 234u34k (6c98256)

k8s-ci-robot · 2026-03-01T16:49:23Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign stephenfin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2026-03-01T16:49:27Z

Hi @234u34k. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-triage-robot · 2026-05-30T19:01:46Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot · 2026-06-29T19:53:50Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle rotten
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

jihyun-huh · 2026-07-13T14:03:54Z

/remove-lifecycle rotten

Hi, thanks for fixing this.
The issue looks valid to me and my team,
actually the Secret template prefers cloudConfigContents when it is initially set, but the DaemonSet checksum currently only hashes the cloudconfig, so update to credentials or endpoints in cloudconfig contents seems do not trigger a rollout.

This change should fix that behaviour and looks safe to merge.

if it is okay, would you kindly add ok-to-test on this PR?
cc. @gouthampacha @stephenfin @kayrus

gouthampacha · 2026-07-13T14:12:06Z

/ok-to-test

gouthampacha · 2026-07-13T15:03:04Z

/lgtm

thank you @jihyun-huh

kayrus · 2026-07-13T15:09:40Z

@jihyun-huh could you bump a corresponding chart version?

cloud-provider-openstack/charts/openstack-cloud-controller-manager/Chart.yaml

Line 7 in 4f3102a

version: 2.36.0

jihyun-huh · 2026-07-13T16:04:46Z

@kayrus
Hi, that makes sense, and noticed that this PR #3039 already bumps the chart version to 2.36.1, so whichever PR merges second will probably just need a small rebase and bump to 2.36.2.

So if you get a chance,, I would really really appreciate another look at #3039 since it's been waiting for review for a while. 🥺

234u34k · 2026-07-14T02:37:16Z

Thanks folks, please let me know if this PR is lacking anything that I can provide

jihyun-huh · 2026-07-20T14:58:37Z

Hi, @kayrus i misunderstood, and yes, the corresponding chart version should be bumped as part of this PR.
i'm not the author of this PR, so @234u34k , could you update Chart.yaml?

the master version is 2.36.0

cloud-provider-openstack/charts/openstack-cloud-controller-manager/Chart.yaml

Line 7 in c453fb7

version: 2.36.0

When cloud config is supplied via cloudConfigContents rather than the structured cloudConfig values, changes to it do not alter the checksum annotation on the DaemonSet pod template. Pods are not restarted after credential rotation or endpoint changes.

234u34k · 2026-07-22T05:29:30Z

/test pull-cloud-provider-openstack-check

234u34k · 2026-07-22T05:48:11Z

Chart version bump and rebase are complete, and CI is green. @gouthampacha could you please restore /lgtm? @zetaab could you review for approval afterward? Thanks.

gouthampacha · 2026-07-25T07:13:15Z

/lgtm

kayrus · 2026-07-25T08:48:26Z

/approve

kubernetes-prow · 2026-07-25T08:48:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kayrus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [kayrus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

234u34k · 2026-07-25T16:53:11Z

Thanks all

k8s-ci-robot added do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 1, 2026

k8s-ci-robot requested review from dulek and stephenfin March 1, 2026 16:49

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 1, 2026

234u34k force-pushed the fix/occm-checksum-cloudconfigcontents branch from c1a5df2 to 6c98256 Compare March 1, 2026 18:36

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Mar 1, 2026

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 30, 2026

kubernetes-prow Bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jun 29, 2026

kubernetes-prow Bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Jul 13, 2026

kubernetes-prow Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 13, 2026

kubernetes-prow Bot assigned gouthampacha Jul 13, 2026

kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 13, 2026

kubernetes-prow Bot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 22, 2026

234u34k added 2 commits July 21, 2026 22:13

Bump openstack-cloud-controller-manager chart to 2.36.1

6d4a519

234u34k force-pushed the fix/occm-checksum-cloudconfigcontents branch from bbdfa77 to 6d4a519 Compare July 22, 2026 05:22

kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 25, 2026

kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 25, 2026

kubernetes-prow Bot merged commit 231a42c into kubernetes:master Jul 25, 2026
5 checks passed

234u34k deleted the fix/occm-checksum-cloudconfigcontents branch July 25, 2026 16:53

jihyun-huh mentioned this pull request Jul 27, 2026

[occm] Fix serviceMonitor labelSelector and remove deprecated bearerTokenFile auth #3039

Open

Uh oh!

Conversation

234u34k commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linux-foundation-easycla Bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Mar 1, 2026

Uh oh!

k8s-ci-robot commented Mar 1, 2026

Uh oh!

k8s-triage-robot commented May 30, 2026

Uh oh!

k8s-triage-robot commented Jun 29, 2026

Uh oh!

jihyun-huh commented Jul 13, 2026

Uh oh!

gouthampacha commented Jul 13, 2026

Uh oh!

gouthampacha commented Jul 13, 2026

Uh oh!

kayrus commented Jul 13, 2026

Uh oh!

jihyun-huh commented Jul 13, 2026

Uh oh!

234u34k commented Jul 14, 2026

Uh oh!

jihyun-huh commented Jul 20, 2026

Uh oh!

234u34k commented Jul 22, 2026

Uh oh!

234u34k commented Jul 22, 2026

Uh oh!

gouthampacha commented Jul 25, 2026

Uh oh!

kayrus commented Jul 25, 2026

Uh oh!

kubernetes-prow Bot commented Jul 25, 2026

Uh oh!

Uh oh!

234u34k commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

234u34k commented Mar 1, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Mar 1, 2026 •

edited

Loading