Install packages updates during bootstrap

[hakman]

During bootstrap packages that are already installed are skipped. They are later installed by the automatic updater.

The PR checks if automatic updates are enabled and tries to install the updated version.
The package managed decides if there is an update to be installed or not, so the only thing that has to be done is try to install it again. The newer the base image, the less updates will be installed.

This is a followup of #8020 and after discussing about the issue during office hours.

[hakman]

/cc @geojaz

[geojaz]

How is tags.TagUpdatePolicyAuto getting set? Or does this change the default behavior? (We should probably avoid that)

I think either this PR (or I) may be missing something. But in general, I'd like to see a bit of documentation about how to enable. It may also be nice to log that this mode has been enabled so users have another way to figure out what's up.
Thanks!

[hakman]

Kops has a feature that does automatic updates on each node. This is enabled by default and can be disabled by setting Cluster.Spec.UpdatePolicy to external:
There is some documentation for the option here:
https://github.com/kubernetes/kops/blob/master/docs/getting_started/arguments.md#updatepolicy

The TagUpdatePolicyAuto is an alias for _automatic_upgrades, which is added only when no UpdatePolicy is set:

kops/upup/pkg/fi/cloudup/tagbuilder.go

Lines 90 to 92 in 77d6d38

	switch fi.StringValue(cluster.Spec.UpdatePolicy) {
	case "": // default
	tags.Insert("_automatic_upgrades")

Instead of waiting for the updater to run (daily), I am trying to update the packages required for Kubernetes during bootstrap.

We discussed this during office hours about a month ago and decided that should be ok to update packages during bootstrap, as long as automatic updates are not enabled.

[geojaz]

ahh! ok, thanks for connecting the dots for me- It seems that I keep asking for clarification on things that were discussed during office hours... I'll try to do better at keeping up with these 🙄

I would still love a quick comment (in tags.go) that reminds people who are scanning the code of the implications of _automatic_upgrades. Something simple like: Nodes with this tag attempt to update packages during bootstrapping instead of daily . See: ... for other options. is that overkill?
I'll take another look in the US daytime :)

[hakman]

I am sure that you have better things to do than remember all the tiny nits from 6 weeks ago. :)
Adding comments sounds very reasonable. Will add some and continue this later.
Thanks!

[hakman]

@geojaz I added the comment and an extra note in docs. I think it's ok for another look. Thanks!

[geojaz]

Suggested change

	// Nodes with the "_automatic_upgrade" tag will update packages for security,
	// but also during bootstrapping. To disable automatic updates set
	// `Cluster.Spec.UpdatePolicy = external`
	// Nodes with the "_automatic_upgrade" tag automatically update packages
	// during bootstrapping and for security updates (unless this update would require
	// a node reboot. To disable automatic node package updates, set:
	// `Cluster.Spec.UpdatePolicy = external`

[geojaz]

This lgtm, but had a suggestion on wording of the comment that may make it more approachable for native english speakers. Hopefully for non-native as well. :) Feel free to suggest a further change, but when you're ready, i'll 👍 this. thanks!

[hakman]

Can't imagine how I could have written such nonsense. Even I don't understand it anymore. :))

[geojaz]

/lgtm
thanks @hakman !

[hakman]

Thanks @geojaz!
Btw, can you also add the approved label?

[geojaz]

Teamwork! I'm just so glad that I don't have to write docs/comments in (your native language- which I don't want to guess). Ahh... I understand why you need an approve as well as a lgtm, but I don't. It's because it automatically adds approved to mine.... not fair.
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: geojaz, hakman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [geojaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment