From c33bf8b1b613eb384e4a2886a7e2c41a0715c866 Mon Sep 17 00:00:00 2001 From: Young Joon Lee Date: Tue, 20 Oct 2026 21:36:45 +0900 Subject: [PATCH 1/2] fix(config): keep config fingerprints stable when exporter_firewall is unset The new exporter_firewall key was encoded without omitempty, so every host's effective config gained "exporter_firewall: false" and no longer matched the fingerprint recorded by its last apply. fleet update then stopped at the first host as unverified. Pin the fingerprint of a minimal config so a future key cannot change it unnoticed. Claude-Session: https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7 --- docs/releases/v0.18.1.md | 6 ++++++ internal/config/config.go | 2 +- internal/config/fingerprint_test.go | 14 ++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 docs/releases/v0.18.1.md diff --git a/docs/releases/v0.18.1.md b/docs/releases/v0.18.1.md new file mode 100644 index 0000000..fcc1841 --- /dev/null +++ b/docs/releases/v0.18.1.md @@ -0,0 +1,6 @@ +Updating to v0.18.0 made every host look unverified to the fleet controller; v0.18.1 restores the recorded configuration match. + +### Fixed +- After `rootfiles fleet update --version v0.18.0`, the post-update check reported "remote config fingerprint is missing; inventory configuration is unverified" on hosts whose config does not set `exporter_firewall`, and the rollout stopped at the first host. Update to v0.18.1 and the check matches the last apply again. (#85) + +**Full changelog**: https://github.com/STAIxBWLB/rootfiles/compare/v0.18.0...v0.18.1 diff --git a/internal/config/config.go b/internal/config/config.go index 6b01146..3190f25 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -146,7 +146,7 @@ type MonitoringConfig struct { PerimeterFirewall bool `yaml:"perimeter_firewall"` // ExporterFirewall installs the iptables guard that admits exporter // traffic only from allow_from (IPv4, one /32, default ports). - ExporterFirewall bool `yaml:"exporter_firewall"` + ExporterFirewall bool `yaml:"exporter_firewall,omitempty"` DCGMExporterImage string `yaml:"dcgm_exporter_image,omitempty"` Hub MonitoringHubConfig `yaml:"hub"` } diff --git a/internal/config/fingerprint_test.go b/internal/config/fingerprint_test.go index 81ce935..3af7c14 100644 --- a/internal/config/fingerprint_test.go +++ b/internal/config/fingerprint_test.go @@ -52,3 +52,17 @@ func TestFingerprintIgnoresRuntimeAndSecretButDetectsIntent(t *testing.T) { t.Fatal("intent change did not affect fingerprint") } } + +// Every host records the fingerprint of its last apply, and fleet rollouts +// stop on a host whose fingerprint no longer matches. A new config key must +// therefore leave the encoding of configs that do not set it unchanged +// (omitempty); this pins the value earlier releases computed. +func TestFingerprintStableAcrossReleases(t *testing.T) { + fp, err := (&Config{Timezone: "UTC"}).Fingerprint() + if err != nil { + t.Fatal(err) + } + if want := "c4ec434e963b8ec0ce76b900c608e439b90f27a533fd581b9401dfbdd5bc89ac"; fp != want { + t.Fatalf("fingerprint changed for a config that sets no new keys: %s, want %s", fp, want) + } +} From 5c12813b87c0bbf892b116aa5ec24325c8912cac Mon Sep 17 00:00:00 2001 From: Young Joon Lee Date: Tue, 20 Oct 2026 22:11:05 +0900 Subject: [PATCH 2/2] docs(release): tell operators to re-apply hosts applied under v0.18.0 Claude-Session: https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7 --- docs/releases/v0.18.1.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/releases/v0.18.1.md b/docs/releases/v0.18.1.md index fcc1841..c745329 100644 --- a/docs/releases/v0.18.1.md +++ b/docs/releases/v0.18.1.md @@ -3,4 +3,7 @@ Updating to v0.18.0 made every host look unverified to the fleet controller; v0. ### Fixed - After `rootfiles fleet update --version v0.18.0`, the post-update check reported "remote config fingerprint is missing; inventory configuration is unverified" on hosts whose config does not set `exporter_firewall`, and the rollout stopped at the first host. Update to v0.18.1 and the check matches the last apply again. (#85) +### Action needed +- A host where `rootfiles apply` already ran under v0.18.0 recorded the v0.18.0 fingerprint. After updating it to v0.18.1, run `sudo rootfiles apply` (or `rootfiles fleet apply --host `) once so the check matches again. (#85) + **Full changelog**: https://github.com/STAIxBWLB/rootfiles/compare/v0.18.0...v0.18.1