Skip to content

[release-2.11] 🐛 fix(eks): add ObservedGeneration to AWSManagedControlPlane to prevent missed spec changes#6090

Open
k8s-infra-cherrypick-robot wants to merge 2 commits into
kubernetes-sigs:release-2.11from
k8s-infra-cherrypick-robot:cherry-pick-6084-to-release-2.11
Open

[release-2.11] 🐛 fix(eks): add ObservedGeneration to AWSManagedControlPlane to prevent missed spec changes#6090
k8s-infra-cherrypick-robot wants to merge 2 commits into
kubernetes-sigs:release-2.11from
k8s-infra-cherrypick-robot:cherry-pick-6084-to-release-2.11

Conversation

@k8s-infra-cherrypick-robot

Copy link
Copy Markdown

This is an automated cherry-pick of #6084

/assign damdo

fix(eks): race condition where AWSManagedControlPlane controller could miss spec changes due to controller-runtime event coalescing by adding status.observedGeneration tracking and conditional requeue.

/cherrypick release-2.10

damdo added 2 commits July 3, 2026 06:52
… missed spec changes

The AWSManagedControlPlane controller could miss spec changes due to
controller-runtime event coalescing. When a long reconcile completes,
the deferred scope.Close() status patch and an external spec patch
(e.g. UpgradePolicy change) can arrive within the same work queue
window and get coalesced into a single reconcile that may read stale
state.

Add status.observedGeneration to AWSManagedControlPlane and wire
WithStatusObservedGeneration into the controller's defer block on
successful reconciliation, matching the pattern already used by
EKSConfigReconciler and NodeadmConfigReconciler.

Also add PrincipalUsageAllowedCondition and
PrincipalCredentialRetrievedCondition to the ManagedControlPlaneScope's
owned conditions list — they were set during scope creation but not
declared as owned, causing patch conflicts.

Harden the upgrade-policy e2e test by verifying the spec patch is
persisted before polling EKS, and increase the EKS API polling timeout
from 5 to 10 minutes.

Signed-off-by: Damiano Donati <damiano.donati@gmail.com>
…d events

When multiple EKS clusters reconcile concurrently, all worker slots can
be occupied for 12+ minutes. Watch events that arrive during this window
get coalesced in the work queue, causing spec changes to be silently
dropped. Add a conditional RequeueAfter when observedGeneration is behind
the current generation, ensuring one follow-up reconcile to process any
spec change that was coalesced. The controller goes quiescent once
observedGeneration catches up.

Signed-off-by: Damiano Donati <damiano.donati@gmail.com>
@kubernetes-prow kubernetes-prow Bot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Jul 3, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign justinsb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot requested a review from faiq July 3, 2026 06:52
@kubernetes-prow kubernetes-prow Bot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 3, 2026
@kubernetes-prow kubernetes-prow Bot requested a review from nrb July 3, 2026 06:52
@kubernetes-prow kubernetes-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 3, 2026
@damdo

damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member

/test ?

@damdo

damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member

/test pull-cluster-api-provider-aws-e2e-release-2-11

/test pull-cluster-api-provider-aws-e2e-eks-release-2-11

@damdo

damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member

/hold

@kubernetes-prow kubernetes-prow Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 3, 2026
@damdo

damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member

/test pull-cluster-api-provider-aws-e2e-eks-release-2-11

1 similar comment
@damdo

damdo commented Jul 4, 2026

Copy link
Copy Markdown
Member

/test pull-cluster-api-provider-aws-e2e-eks-release-2-11

@kubernetes-prow

Copy link
Copy Markdown
Contributor

@k8s-infra-cherrypick-robot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-cluster-api-provider-aws-e2e-eks-release-2-11 92bd0bb link false /test pull-cluster-api-provider-aws-e2e-eks-release-2-11

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. needs-priority release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants