🌱 Deprecate (ssh) PortAfterCloudInit. (#1670)

guettli · web-flow · commit d750d2736997 · 2025-09-12T15:49:06.000+02:00
* 🌱 Deprecate (ssh) PortAfterCloudInit. Since [PR Install Cloud-Init-Data via post-install.sh #1407](#1407) this field is not functional. The additional reboot after InstallImage was removed. The ssh port after InstallImage is the port which gets used.
diff --git a/api/v1beta1/hetznerbaremetalmachine_types.go b/api/v1beta1/hetznerbaremetalmachine_types.go
@@ -121,8 +121,8 @@ type SSHSpec struct {
 	// +optional
 	PortAfterInstallImage int `json:"portAfterInstallImage"`
 
-	// PortAfterCloudInit specifies the port that has to be used to connect to the machine
-	// by reaching the server via SSH after the successful completion of cloud init.
+	// PortAfterCloudInit is deprecated. Since PR Install Cloud-Init-Data via post-install.sh #1407 this field is not functional.
+	// Deprecated: This field is not used anymore.
 	// +optional
 	PortAfterCloudInit int `json:"portAfterCloudInit"`
 }
diff --git a/api/v1beta1/hetznerbaremetalmachine_validation_test.go b/api/v1beta1/hetznerbaremetalmachine_validation_test.go
@@ -267,7 +267,6 @@ func TestValidateHetznerBareMetalMachineSpecUpdate(t *testing.T) {
 							},
 						},
 						PortAfterInstallImage: 22,
-						PortAfterCloudInit:    22,
 					},
 				},
 				newSpec: HetznerBareMetalMachineSpec{
@@ -281,7 +280,6 @@ func TestValidateHetznerBareMetalMachineSpecUpdate(t *testing.T) {
 							},
 						},
 						PortAfterInstallImage: 2222,
-						PortAfterCloudInit:    2222,
 					},
 				},
 			},
@@ -295,7 +293,6 @@ func TestValidateHetznerBareMetalMachineSpecUpdate(t *testing.T) {
 					},
 				},
 				PortAfterInstallImage: 2222,
-				PortAfterCloudInit:    2222,
 			}, "sshSpec immutable"),
 		},
 		{
@@ -363,7 +360,6 @@ func TestValidateHetznerBareMetalMachineSpecUpdate(t *testing.T) {
 							},
 						},
 						PortAfterInstallImage: 22,
-						PortAfterCloudInit:    22,
 					},
 					HostSelector: HostSelector{
 						MatchLabels: map[string]string{
@@ -395,7 +391,6 @@ func TestValidateHetznerBareMetalMachineSpecUpdate(t *testing.T) {
 							},
 						},
 						PortAfterInstallImage: 22,
-						PortAfterCloudInit:    22,
 					},
 					HostSelector: HostSelector{
 						MatchLabels: map[string]string{
diff --git a/api/v1beta1/hetznerbaremetalmachine_webhook.go b/api/v1beta1/hetznerbaremetalmachine_webhook.go
@@ -43,12 +43,7 @@ var _ webhook.Validator = &HetznerBareMetalMachine{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type.
 func (bmMachine *HetznerBareMetalMachine) ValidateCreate() (admission.Warnings, error) {
-	if bmMachine.Spec.SSHSpec.PortAfterCloudInit == 0 {
-		bmMachine.Spec.SSHSpec.PortAfterCloudInit = bmMachine.Spec.SSHSpec.PortAfterInstallImage
-	}
-
 	allErrs := validateHetznerBareMetalMachineSpecCreate(bmMachine.Spec)
-
 	return nil, aggregateObjErrors(bmMachine.GroupVersionKind().GroupKind(), bmMachine.Name, allErrs)
 }
 
diff --git a/api/v1beta1/hetznerbaremetalmachinetemplate_webhook.go b/api/v1beta1/hetznerbaremetalmachinetemplate_webhook.go
@@ -47,16 +47,7 @@ type HetznerBareMetalMachineTemplateWebhook struct{}
 var _ webhook.CustomValidator = &HetznerBareMetalMachineTemplateWebhook{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type.
-func (r *HetznerBareMetalMachineTemplateWebhook) ValidateCreate(_ context.Context, raw runtime.Object) (admission.Warnings, error) {
-	hbmmt, ok := raw.(*HetznerBareMetalMachineTemplate)
-	if !ok {
-		return nil, apierrors.NewBadRequest(fmt.Sprintf("expected a HetznerBareMetalMachineTemplate but got a %T", raw))
-	}
-
-	if hbmmt.Spec.Template.Spec.SSHSpec.PortAfterCloudInit == 0 {
-		hbmmt.Spec.Template.Spec.SSHSpec.PortAfterCloudInit = hbmmt.Spec.Template.Spec.SSHSpec.PortAfterInstallImage
-	}
-
+func (r *HetznerBareMetalMachineTemplateWebhook) ValidateCreate(_ context.Context, _ runtime.Object) (admission.Warnings, error) {
 	// TODO: Cannot validate it because ClusterClass applies empty template objects
 	// allErrs := validateHetznerBareMetalMachineSpecCreate(hbmmt.Spec.Template.Spec)
 	return nil, nil
diff --git a/config/crd/bases/infrastructure.cluster.x-k8s.io_hetznerbaremetalhosts.yaml b/config/crd/bases/infrastructure.cluster.x-k8s.io_hetznerbaremetalhosts.yaml
@@ -499,8 +499,8 @@ spec:
                     properties:
                       portAfterCloudInit:
                         description: |-
-                          PortAfterCloudInit specifies the port that has to be used to connect to the machine
-                          by reaching the server via SSH after the successful completion of cloud init.
+                          PortAfterCloudInit is deprecated. Since PR Install Cloud-Init-Data via post-install.sh #1407 this field is not functional.
+                          Deprecated: This field is not used anymore.
                         type: integer
                       portAfterInstallImage:
                         default: 22
diff --git a/config/crd/bases/infrastructure.cluster.x-k8s.io_hetznerbaremetalmachines.yaml b/config/crd/bases/infrastructure.cluster.x-k8s.io_hetznerbaremetalmachines.yaml
@@ -258,8 +258,8 @@ spec:
                 properties:
                   portAfterCloudInit:
                     description: |-
-                      PortAfterCloudInit specifies the port that has to be used to connect to the machine
-                      by reaching the server via SSH after the successful completion of cloud init.
+                      PortAfterCloudInit is deprecated. Since PR Install Cloud-Init-Data via post-install.sh #1407 this field is not functional.
+                      Deprecated: This field is not used anymore.
                     type: integer
                   portAfterInstallImage:
                     default: 22
diff --git a/config/crd/bases/infrastructure.cluster.x-k8s.io_hetznerbaremetalmachinetemplates.yaml b/config/crd/bases/infrastructure.cluster.x-k8s.io_hetznerbaremetalmachinetemplates.yaml
@@ -245,8 +245,8 @@ spec:
                         properties:
                           portAfterCloudInit:
                             description: |-
-                              PortAfterCloudInit specifies the port that has to be used to connect to the machine
-                              by reaching the server via SSH after the successful completion of cloud init.
+                              PortAfterCloudInit is deprecated. Since PR Install Cloud-Init-Data via post-install.sh #1407 this field is not functional.
+                              Deprecated: This field is not used anymore.
                             type: integer
                           portAfterInstallImage:
                             default: 22
diff --git a/controllers/controllers_suite_test.go b/controllers/controllers_suite_test.go
@@ -285,7 +285,6 @@ func getDefaultHetznerBareMetalMachineSpec() infrav1.HetznerBareMetalMachineSpec
 				},
 			},
 			PortAfterInstallImage: 22,
-			PortAfterCloudInit:    22,
 		},
 	}
 }
diff --git a/controllers/hetznerbaremetalhost_controller_test.go b/controllers/hetznerbaremetalhost_controller_test.go
@@ -550,7 +550,6 @@ var _ = Describe("HetznerBareMetalHostReconciler", func() {
 				Spec: getDefaultHetznerBareMetalMachineSpec(),
 			}
 			bmMachine.Spec.SSHSpec.PortAfterInstallImage = 23
-			bmMachine.Spec.SSHSpec.PortAfterCloudInit = 24
 
 			Expect(testEnv.Create(ctx, bmMachine)).To(Succeed())
 		})
diff --git a/controllers/hetznerbaremetalmachine_controller_test.go b/controllers/hetznerbaremetalmachine_controller_test.go
@@ -791,7 +791,6 @@ var _ = Describe("HetznerBareMetalMachineReconciler", func() {
 									},
 								},
 								PortAfterInstallImage: 2222,
-								PortAfterCloudInit:    2222,
 							},
 						},
 					},
diff --git a/docs/caph/03-reference/06-hetzner-bare-metal-machine-template.md b/docs/caph/03-reference/06-hetzner-bare-metal-machine-template.md
@@ -79,7 +79,7 @@ Via MatchLabels you can specify a certain label (key and value) that identifies
 | `template.spec.sshSpec.secretRef.key.publicKey`                  | `string`              |                           | yes      | PublicKey is the key in the secret's data where the SSH key's public key is stored                                                                 |
 | `template.spec.sshSpec.secretRef.key.privateKey`                 | `string`              |                           | yes      | PrivateKey is the key in the secret's data where the SSH key's private key is stored                                                               |
 | `template.spec.sshSpec.portAfterInstallImage`                    | `int`                 | `22`                      | no       | PortAfterInstallImage specifies the port that can be used to reach the server via SSH after install image completed successfully                   |
-| `template.spec.sshSpec.portAfterCloudInit`                       | `int`                 | `22` (install image port) | no       | PortAfterCloudInit specifies the port that can be used to reach the server via SSH after cloud init completed successfully                         |
+| `template.spec.sshSpec.portAfterCloudInit`                       | `int`                 | `22` (install image port) | no       | PortAfterCloudInit specifies the port that can be used to reach the server via SSH after cloud init completed successfully. Deprecated. Since [PR Install Cloud-Init-Data via post-install.sh #1407](https://github.com/syself/cluster-api-provider-hetzner/pull/1407) this field is not functional.  |
 
 ## installImage.image
 
diff --git a/pkg/services/baremetal/host/host.go b/pkg/services/baremetal/host/host.go
@@ -240,7 +240,7 @@ func (s *Service) actionPreparing(ctx context.Context) actionResult {
 
 	sshClient := s.scope.SSHClientFactory.NewClient(sshclient.Input{
 		PrivateKey: sshclient.CredentialsFromSecret(s.scope.OSSSHSecret, s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.SecretRef).PrivateKey,
-		Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterCloudInit,
+		Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterInstallImage,
 		IP:         s.scope.HetznerBareMetalHost.Spec.Status.GetIPAddress(),
 	})
 
@@ -1563,7 +1563,7 @@ func (s *Service) actionEnsureProvisioned(ctx context.Context) (ar actionResult)
 	markProvisionPending(s.scope.HetznerBareMetalHost, infrav1.StateEnsureProvisioned)
 	sshClient := s.scope.SSHClientFactory.NewClient(sshclient.Input{
 		PrivateKey: sshclient.CredentialsFromSecret(s.scope.OSSSHSecret, s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.SecretRef).PrivateKey,
-		Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterCloudInit,
+		Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterInstallImage,
 		IP:         s.scope.HetznerBareMetalHost.Spec.Status.GetIPAddress(),
 	})
 
@@ -1588,13 +1588,6 @@ func (s *Service) actionEnsureProvisioned(ctx context.Context) (ar actionResult)
 			}
 			return actionError{err: fmt.Errorf("failed to handle incomplete boot - provisioning: %w", err)}
 		}
-		// A connection failed error could mean that cloud init is still running (if cloudInit introduces a new port)
-		if isSSHConnectionRefusedError {
-			if actionRes := s.handleConnectionRefused(ctx); actionRes != nil {
-				s.scope.Logger.Info("ensureProvisioned: ConnectionRefused", "actionResult", actionRes)
-				return actionRes
-			}
-		}
 
 		failed, err := s.handleIncompleteBoot(ctx, false, isTimeout, isSSHConnectionRefusedError)
 		if failed {
@@ -1647,15 +1640,10 @@ func (s *Service) actionEnsureProvisioned(ctx context.Context) (ar actionResult)
 		return createEventWithCloudInitOutput(actResult)
 	}
 
-	// Check whether cloud init did not run successfully even though it shows "done"
-	// Check this only when the port did not change. Because if it did, then we can already confirm at this point
-	// that the change worked and the new port is usable. This is a strong enough indication for us to assume cloud init worked.
-	if s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterInstallImage == s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterCloudInit {
-		actResult = s.handleCloudInitNotStarted(ctx)
-		if _, complete := actResult.(actionComplete); !complete {
-			s.scope.Logger.Info("ensureProvisioned: handleCloudInitNotStarted", "actResult", actResult)
-			return createEventWithCloudInitOutput(actResult)
-		}
+	actResult = s.handleCloudInitNotStarted(ctx)
+	if _, complete := actResult.(actionComplete); !complete {
+		s.scope.Logger.Info("ensureProvisioned: handleCloudInitNotStarted", "actResult", actResult)
+		return createEventWithCloudInitOutput(actResult)
 	}
 
 	record.Event(s.scope.HetznerBareMetalHost, "ServerProvisioned", "server successfully provisioned")
@@ -1664,39 +1652,6 @@ func (s *Service) actionEnsureProvisioned(ctx context.Context) (ar actionResult)
 	return createEventWithCloudInitOutput(actionComplete{})
 }
 
-// handleConnectionRefused checks cloud init status via ssh to the old ssh port if the new ssh port
-// gave a connection refused error.
-func (s *Service) handleConnectionRefused(ctx context.Context) actionResult {
-	// Nothing to do if ports didn't change.
-	if s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterInstallImage == s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterCloudInit {
-		return nil
-	}
-	oldSSHClient := s.scope.SSHClientFactory.NewClient(sshclient.Input{
-		PrivateKey: sshclient.CredentialsFromSecret(s.scope.OSSSHSecret, s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.SecretRef).PrivateKey,
-		Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterInstallImage,
-		IP:         s.scope.HetznerBareMetalHost.Spec.Status.GetIPAddress(),
-	})
-	actResult, _, err := s.checkCloudInitStatus(ctx, oldSSHClient)
-	// If this ssh client also gives an error, then we go back to analyzing the error of the first ssh call
-	// This happens in the statement below this one.
-	if err == nil {
-		// If cloud-init status == "done" and cloud init was successful,
-		// then we will soon reboot and be able to access the server via the new port
-		if _, complete := actResult.(actionComplete); complete {
-			// Check whether cloud init did not run successfully even though it shows "done"
-			actResult := s.handleCloudInitNotStarted(ctx)
-			if _, complete := actResult.(actionComplete); complete {
-				return actionContinue{delay: 10 * time.Second}
-			}
-			return actResult
-		}
-	}
-	if _, actionerr := actResult.(actionError); !actionerr {
-		return actResult
-	}
-	return nil
-}
-
 func (s *Service) checkCloudInitStatus(ctx context.Context, sshClient sshclient.Client) (actionResult, string, error) {
 	out := sshClient.CloudInitStatus()
 	// This error is interesting for further logic and might happen because of the fact that the sshClient has the wrong port
@@ -1817,7 +1772,7 @@ func (s *Service) actionProvisioned(ctx context.Context) actionResult {
 	creds := sshclient.CredentialsFromSecret(s.scope.OSSSHSecret, s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.SecretRef)
 	in := sshclient.Input{
 		PrivateKey: creds.PrivateKey,
-		Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterCloudInit,
+		Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterInstallImage,
 		IP:         s.scope.HetznerBareMetalHost.Spec.Status.GetIPAddress(),
 	}
 	sshClient := s.scope.SSHClientFactory.NewClient(in)
@@ -1886,7 +1841,7 @@ func (s *Service) actionDeprovisioning(_ context.Context) actionResult {
 	if s.scope.OSSSHSecret != nil {
 		sshClient := s.scope.SSHClientFactory.NewClient(sshclient.Input{
 			PrivateKey: sshclient.CredentialsFromSecret(s.scope.OSSSHSecret, s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.SecretRef).PrivateKey,
-			Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterCloudInit,
+			Port:       s.scope.HetznerBareMetalHost.Spec.Status.SSHSpec.PortAfterInstallImage,
 			IP:         s.scope.HetznerBareMetalHost.Spec.Status.GetIPAddress(),
 		})
 		out := sshClient.ResetKubeadm()
diff --git a/pkg/services/baremetal/host/host_test.go b/pkg/services/baremetal/host/host_test.go
diff --git a/pkg/services/baremetal/host/state_machine_test.go b/pkg/services/baremetal/host/state_machine_test.go
diff --git a/test/helpers/defaults.go b/test/helpers/defaults.go

Original file line number	Diff line number	Diff line change
`@@ -285,7 +285,6 @@ func getDefaultHetznerBareMetalMachineSpec() infrav1.HetznerBareMetalMachineSpec`
`285`	`285`	`},`
`286`	`286`	`},`
`287`	`287`	`PortAfterInstallImage: 22,`
`288`		`- PortAfterCloudInit: 22,`
`289`	`288`	`},`
`290`	`289`	`}`
`291`	`290`	`}`
Original file line number	Diff line number	Diff line change
`@@ -550,7 +550,6 @@ var _ = Describe("HetznerBareMetalHostReconciler", func() {`
`550`	`550`	`Spec: getDefaultHetznerBareMetalMachineSpec(),`
`551`	`551`	`}`
`552`	`552`	`bmMachine.Spec.SSHSpec.PortAfterInstallImage = 23`
`553`		`- bmMachine.Spec.SSHSpec.PortAfterCloudInit = 24`
`554`	`553`
`555`	`554`	`Expect(testEnv.Create(ctx, bmMachine)).To(Succeed())`
`556`	`555`	`})`