fix(operator): memory leak from opening large files (#2218)

* fix(operator): memory leak from opening large files

Author: emosbaugh

cmd/installer/cli/enable_ha.go

@@ -54,6 +54,11 @@ func runEnableHA(ctx context.Context) error {
 		return fmt.Errorf("unable to get kube client: %w", err)
 	}
 
+	mcli, err := kubeutils.MetadataClient()
+	if err != nil {
+		return fmt.Errorf("unable to create metadata client: %w", err)
+	}
+
 	canEnableHA, reason, err := addons.CanEnableHA(ctx, kcli)
 	if err != nil {
 		return fmt.Errorf("unable to check if HA can be enabled: %w", err)
@@ -91,5 +96,5 @@ func runEnableHA(ctx context.Context) error {
 	loading := spinner.Start()
 	defer loading.Close()
 
-	return addons.EnableHA(ctx, logrus.Debugf, kcli, kclient, hcli, in.Spec.Network.ServiceCIDR, in.Spec, loading)
+	return addons.EnableHA(ctx, logrus.Debugf, kcli, mcli, kclient, hcli, in.Spec.Network.ServiceCIDR, in.Spec, loading)
 }

cmd/installer/cli/join.go

@@ -34,6 +34,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v2"
+	"k8s.io/client-go/metadata"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	k8syaml "sigs.k8s.io/yaml"
 )
@@ -186,6 +187,12 @@ func runJoin(ctx context.Context, name string, flags JoinCmdFlags, jcmd *join.Jo
 		return fmt.Errorf("unable to get kube client: %w", err)
 	}
 
+	mcli, err := kubeutils.MetadataClient()
+	if err != nil {
+		loading.ErrorClosef("Failed to install node")
+		return fmt.Errorf("unable to get metadata client: %w", err)
+	}
+
 	hostname, err := os.Hostname()
 	if err != nil {
 		loading.ErrorClosef("Failed to install node")
@@ -207,7 +214,7 @@ func runJoin(ctx context.Context, name string, flags JoinCmdFlags, jcmd *join.Jo
 		return nil
 	}
 
-	if err := maybeEnableHA(ctx, kcli, flags, cidrCfg.ServiceCIDR, jcmd); err != nil {
+	if err := maybeEnableHA(ctx, kcli, mcli, flags, cidrCfg.ServiceCIDR, jcmd); err != nil {
 		return fmt.Errorf("unable to enable high availability: %w", err)
 	}
 
@@ -565,7 +572,7 @@ func waitForNodeToJoin(ctx context.Context, kcli client.Client, hostname string,
 	return nil
 }
 
-func maybeEnableHA(ctx context.Context, kcli client.Client, flags JoinCmdFlags, serviceCIDR string, jcmd *join.JoinCommandResponse) error {
+func maybeEnableHA(ctx context.Context, kcli client.Client, mcli metadata.Interface, flags JoinCmdFlags, serviceCIDR string, jcmd *join.JoinCommandResponse) error {
 	if flags.noHA {
 		logrus.Debug("--no-ha flag provided, skipping high availability")
 		return nil
@@ -627,6 +634,7 @@ func maybeEnableHA(ctx context.Context, kcli client.Client, flags JoinCmdFlags,
 		ctx,
 		logrus.Debugf,
 		kcli,
+		mcli,
 		kclient,
 		hcli,
 		serviceCIDR,

cmd/installer/cli/restore.go

@@ -559,6 +559,11 @@ func runRestoreEnableAdminConsoleHA(ctx context.Context, flags InstallCmdFlags,
 		return fmt.Errorf("unable to create kube client: %w", err)
 	}
 
+	mcli, err := kubeutils.MetadataClient()
+	if err != nil {
+		return fmt.Errorf("unable to create metadata client: %w", err)
+	}
+
 	in, err := kubeutils.GetLatestInstallation(ctx, kcli)
 	if err != nil {
 		return fmt.Errorf("get latest installation: %w", err)
@@ -579,7 +584,7 @@ func runRestoreEnableAdminConsoleHA(ctx context.Context, flags InstallCmdFlags,
 	}
 	defer hcli.Close()
 
-	err = addons.EnableAdminConsoleHA(ctx, logrus.Debugf, kcli, hcli, flags.isAirgap, flags.cidrCfg.ServiceCIDR, flags.proxy, in.Spec.Config, in.Spec.LicenseInfo)
+	err = addons.EnableAdminConsoleHA(ctx, logrus.Debugf, kcli, mcli, hcli, flags.isAirgap, flags.cidrCfg.ServiceCIDR, flags.proxy, in.Spec.Config, in.Spec.LicenseInfo)
 	if err != nil {
 		return err
 	}

e2e/cluster/cmx/cluster.go

@@ -265,7 +265,7 @@ func (c *Cluster) waitForClockSync(node int) {
 		select {
 		case <-timeout:
 			stdout, stderr, err := c.RunCommandOnNode(node, []string{"timedatectl show -p NTP -p NTPSynchronized"})
-			c.t.Fatalf("timeout waiting for clock sync: %v: %s: %s", err, stdout, stderr)
+			c.t.Fatalf("timeout waiting for clock sync on node %d: %v: %s: %s", node, err, stdout, stderr)
 		case <-tick:
 			status, _, _ := c.RunCommandOnNode(node, []string{"timedatectl show -p NTP -p NTPSynchronized"})
 			if strings.Contains(status, "NTP=yes") && strings.Contains(status, "NTPSynchronized=yes") {

go.mod

@@ -370,7 +370,7 @@ require (
 	golang.org/x/net v0.40.0 // indirect
 	golang.org/x/oauth2 v0.28.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/text v0.25.0
 	golang.org/x/time v0.9.0 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

operator/controllers/installation_controller.go

@@ -41,6 +41,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/discovery"
+	"k8s.io/client-go/metadata"
 	"k8s.io/client-go/tools/record"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -128,9 +129,10 @@ type NodeEventsBatch struct {
 // InstallationReconciler reconciles a Installation object
 type InstallationReconciler struct {
 	client.Client
-	Discovery discovery.DiscoveryInterface
-	Scheme    *runtime.Scheme
-	Recorder  record.EventRecorder
+	MetadataClient metadata.Interface
+	Discovery      discovery.DiscoveryInterface
+	Scheme         *runtime.Scheme
+	Recorder       record.EventRecorder
 }
 
 // NodeHasChanged returns true if the node configuration has changed when compared to
@@ -446,8 +448,19 @@ func (r *InstallationReconciler) reconcileHostCABundle(ctx context.Context) erro
 		return nil
 	}
 
+	err := r.Get(ctx, types.NamespacedName{Name: "kotsadm"}, &corev1.Namespace{})
+	if k8serrors.IsNotFound(err) {
+		// if the namespace has not been created yet, we don't need to reconcile the CA configmap
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("failed to get kotsadm namespace: %w", err)
+	}
+
 	logger := ctrl.LoggerFrom(ctx)
-	err := adminconsole.EnsureCAConfigmap(ctx, logger.Info, r.Client, caPathInContainer)
+	logf := func(format string, args ...interface{}) {
+		logger.Info(fmt.Sprintf(format, args...))
+	}
+	err = adminconsole.EnsureCAConfigmap(ctx, logf, r.Client, r.MetadataClient, caPathInContainer)
 	if k8serrors.IsRequestEntityTooLargeError(err) || errors.Is(err, fs.ErrNotExist) {
 		logger.Error(err, "Failed to reconcile host ca bundle")
 		return nil