fix: Always refresh the default hooks during upgrades (#5009)

(cherry picked from commit 0f715db)

Author: petrutlucian94

.github/workflows/build-snap.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   build:
     name: Create snap package
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checking out repo
@@ -15,7 +15,9 @@ jobs:
         run: |
           sudo lxd init --auto
           sudo usermod --append --groups lxd $USER
-          sg lxd -c 'lxc version'
+          # `newgrp` does not work in GitHub Actions; use `sudo --user` instead
+          # See https://github.com/actions/runner-images/issues/9932#issuecomment-2573170305
+          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- lxc version
       # Docker sets iptables rules that interfere with LXD or K8s.
       # https://documentation.ubuntu.com/lxd/en/latest/howto/network_bridge_firewalld/#prevent-connectivity-issues-with-lxd-and-docker
       - name: Apply Docker iptables workaround
@@ -30,7 +32,7 @@ jobs:
           sudo snap refresh snapd --channel=latest/stable
       - name: Build snap
         run: |
-          sg lxd -c 'snapcraft --use-lxd'
+          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- snapcraft --use-lxd
           sudo mv microk8s*.snap microk8s.snap
       - name: Uploading snap
         uses: actions/upload-artifact@v4
@@ -40,7 +42,7 @@ jobs:
 
   test-upgrade:
     name: Upgrade path test
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: build
     timeout-minutes: 30
     steps:
@@ -54,7 +56,7 @@ jobs:
 
   test-addons-core:
     name: Test core addons
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: build
     timeout-minutes: 30
     steps:
@@ -77,9 +79,9 @@ jobs:
 
   test-addons-community:
     name: Test community addons
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: build
-    timeout-minutes: 30
+    timeout-minutes: 60
     steps:
       - name: Checking out repo
         uses: actions/checkout@v4
@@ -99,7 +101,7 @@ jobs:
 
   test-addons-core-upgrade:
     name: Test core addons upgrade
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: build
     timeout-minutes: 30
     steps:
@@ -117,7 +119,7 @@ jobs:
 
   test-cluster-agent:
     name: Cluster agent health check
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: build
     timeout-minutes: 30
     steps:
@@ -134,7 +136,7 @@ jobs:
 
   test-airgap:
     name: Test airgap installation
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: build
     timeout-minutes: 30
     steps:
@@ -147,14 +149,16 @@ jobs:
           sudo lxd init --auto
           sudo lxc network set lxdbr0 ipv6.address=none
           sudo usermod --append --groups lxd $USER
-          sg lxd -c 'lxc version'
+          # `newgrp` does not work in GitHub Actions; use `sudo --user` instead
+          # See https://github.com/actions/runner-images/issues/9932#issuecomment-2573170305
+          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- lxc version
       - name: Run airgap tests
         run: |
           sudo -E bash -x -c "./tests/libs/airgap.sh --distro ubuntu:22.04 --channel $PWD/build/microk8s.snap"
 
   security-scan:
     name: Security scan
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: build
     timeout-minutes: 30
     steps:

snap/hooks/configure

@@ -220,16 +220,13 @@ then
 
 fi
 
-# Install default-hooks
-if ! [ -d "${SNAP_COMMON}/hooks" ]
-then
-  cp -r --preserve=mode ${SNAP}/default-hooks ${SNAP_COMMON}/hooks
-fi
-
-# (1.28 -> 1.29) Install 10-pods-restart hook if missing
-if ! [ -e "${SNAP_COMMON}/hooks/reconcile.d/10-pods-restart" ]; then
-  cp -r --preserve=mode "${SNAP}/default-hooks/reconcile.d/10-pods-restart" "${SNAP_COMMON}/hooks/reconcile.d/10-pods-restart"
-fi
+# Install default-hooks.
+#
+# Updated hooks may contain fixes, so we'll always replace existing files.
+# Custom hooks are expected to use separate files so that they won't get
+# overwritten during upgrades.
+mkdir -p ${SNAP_COMMON}/hooks
+cp -r --preserve=mode ${SNAP}/default-hooks/* ${SNAP_COMMON}/hooks/
 
 # Make sure the server certificate includes the IP we are using
 if [ "$(produce_certs)" == "1" ]

tests/utils.py

@@ -100,9 +100,12 @@ def wait_for_pod_state(
     deadline = datetime.datetime.now() + datetime.timedelta(seconds=timeout_insec)
     while True:
         if datetime.datetime.now() > deadline:
-            raise TimeoutError(
-                "Pod {} not in {} after {} seconds.".format(pod, desired_state, timeout_insec)
-            )
+            all_res = kubectl("get all -A")
+            err_msg = f"Pod {pod} not in {desired_state} after {timeout_insec} seconds, "
+            err_msg += f"label: {label}, desired_reason: {desired_reason}.\n"
+            print(err_msg)
+            print(f"kubectl get all -A\n{all_res}\n")
+            raise TimeoutError(err_msg)
         cmd = "po {} -n {}".format(pod, namespace)
         if label:
             cmd += " -l {}".format(label)

tests/validators.py

@@ -57,7 +57,9 @@ def validate_storage():
         )
         kubectl(cmd)
 
-    wait_for_pod_state("", "kube-system", "running", label="k8s-app=hostpath-provisioner")
+    wait_for_pod_state(
+        "", "kube-system", "running", label="k8s-app=hostpath-provisioner"
+    )
     manifest = TEMPLATES / "pvc.yaml"
     kubectl("apply -f {}".format(manifest))
     wait_for_pod_state("hostpath-test-pod", "default", "running")
@@ -101,7 +103,9 @@ def common_ingress():
     while attempt >= 0:
         try:
             resp = requests.get("http://microbot.127.0.0.1.nip.io/")
-            if resp.status_code == 200 and "microbot.png" in resp.content.decode("utf-8"):
+            if resp.status_code == 200 and "microbot.png" in resp.content.decode(
+                "utf-8"
+            ):
                 service_ok = True
                 break
         except requests.RequestException:
@@ -118,9 +122,13 @@ def validate_ingress():
     daemonset = kubectl("get ds")
     if "nginx-ingress-microk8s-controller" in daemonset:
         wait_for_pod_state("", "default", "running", label="app=default-http-backend")
-        wait_for_pod_state("", "default", "running", label="name=nginx-ingress-microk8s")
+        wait_for_pod_state(
+            "", "default", "running", label="name=nginx-ingress-microk8s"
+        )
     else:
-        wait_for_pod_state("", "ingress", "running", label="name=nginx-ingress-microk8s")
+        wait_for_pod_state(
+            "", "ingress", "running", label="name=nginx-ingress-microk8s"
+        )
 
     manifest = TEMPLATES / "ingress.yaml"
     update_yaml_with_arch(manifest)