Repository navigation
CKS: change the service offering, root disk size and affinity groups of a cluster's nodes, restarting them a few at a time #14615
Description
problem
The service offering, root disk size and affinity groups of the nodes of an existing CKS (CloudManaged) Kubernetes cluster can't be changed in a way that keeps the workloads running:
scaleKubernetesClusterwith a new service offering (serviceofferingidornodeofferings) changes every node of the type at once, with no cordon or drain.- The root disk size of the nodes is fixed at creation. A node that runs out of disk can only be grown by hand, one volume at a time, outside CKS.
- The affinity groups of the nodes are set at creation. Changing them needs each VM stopped by hand, and CKS keeps creating new nodes with the old groups.
There's no supported way to move the nodes of a cluster to new settings a few at a time, for example to spread the workers over hosts with an anti-affinity group, or to give the control plane more memory.
versions
Apache CloudStack main (24.0), CKS with CloudManaged clusters. Not specific to a hypervisor or a storage type.
The steps to reproduce the bug
- Create a CKS cluster with 3 workers.
- Try to give the workers a larger root disk, a different service offering than the control nodes, or a new anti-affinity group.
- There is no API for the root disk or the affinity groups. The scale changes the offering of every worker at once, without draining them.
What to do about it?
Let updateKubernetesCluster set the service offering, root disk size and affinity groups of each node type (control, worker, etcd). New nodes get these settings. With rollout=true, the existing nodes that differ are restarted with them a few at a time: each node is cordoned and drained, its VM is stopped, changed and started, and the node is uncordoned once Kubernetes reports it Ready again. The rollout can be resumed if it stops, and other operations are refused while it runs.
Activity
github-actions commentedon Nov 9, 2026
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
🎯 Triage report
The request is to change the service offering, root disk size and affinity groups of each node type in an existing CKS cluster, applying them with a rolling restart. Today the offering change applies to all nodes at once without a drain, root disk size is fixed at creation, and affinity groups can only be set at creation. The reporter proposes
updateKubernetesClustersupport with a resumable, cordon-drain-restart rollout. A pull request (#14616) is already open for this.📊 Assessment
🔗 Similar issues
💡 Notes and suggestions
Add this agentic workflow to your repo
To install this agentic workflow, run