kubelet-wrapper can't execute in CoreOS 1045.0.0/rkt 1.5.1

[mischief]

sometime between rkt 1.2.1 and 1.5.1, it now checks if the path to the stage1 given to --stage1-path is 'trusted', and if not, tries to verify the signature. kubelet-wrapper uses the 'old' path, /usr/share/rkt/stage1-fly.aci, which is symlinked into the new rkt stage1 dir, but not 'trusted' by rkt, resulting in the error:

image: using image from file /usr/share/rkt/stage1-fly.aci
run: open /usr/share/rkt/stage1-fly.aci.asc: no such file or directory

[philips]

@mischief what is the fix? Are we pausing updates?!

[crawford]

@philips we are going to continue rolling out 1032.1.0 while we figure this one out.

[mischief]

@philips: see coreos/coreos-overlay#1959

[crawford]

Fixed by coreos/coreos-overlay#1959.