CKS: the binaries ISO builder bundles an unpinned autoscaler and CCM, and records nothing about what it contains #14648

problem

scripts/util/create-kubernetes-binaries-iso.sh builds the CKS binaries ISO, but it does not pin two of the add-ons it bundles:

• Cluster autoscaler. The manifest is downloaded from the master branch of kubernetes/autoscaler (cluster-autoscaler/cloudprovider/cloudstack/examples/cluster-autoscaler-standard.yaml, next to a # TODO : Change the url once merged). The image bundled is whatever that manifest names, which is apache/cloudstack-kubernetes-autoscaler:latest. That tag was last pushed in March 2022 and is a 1.24.0-alpha development build. The cluster-autoscaler only supports the Kubernetes minor version it was released with, so every ISO for Kubernetes 1.25 or later ships an autoscaler built for a different Kubernetes version.
• Cloud controller manager. The manifest comes from the main branch of apache/cloudstack-kubernetes-provider (deployment.yaml), and the image is whatever main names on the day of the build. ISOs built before December 2025 got v1.1.0 this way. v1.1.0 does not initialise nodes (Fix providerID implementation cloudstack-kubernetes-provider#58, fixed in v1.2.0).

So two ISOs labelled with the same Kubernetes version can contain different add-ons, and a rebuild can pick up a breaking change without anyone noticing. Nothing in the ISO records which versions it contains.

Most of the downloads also use curl -sSL or curl -L without -f, so a 404 is saved as the file and goes into the ISO.

#14598 fixes the same kind of download problem in the node-side scripts (deploy-provider, autoscale-kube-cluster, deploy-csi-driver), but leaves the ISO builder and the version pinning alone.

versions

4.22 and main. The autoscaler and CCM URLs are the same on both branches.

The steps to reproduce the bug

1. Run scripts/util/create-kubernetes-binaries-iso.sh for any Kubernetes version, e.g. 1.31.14.
2. Mount the ISO and look at autoscaler.yaml and provider.yaml.
3. The autoscaler image is apache/cloudstack-kubernetes-autoscaler:latest whatever the Kubernetes version. The CCM image is whatever main of cloudstack-kubernetes-provider named that day.

What to do about it?

• Download the autoscaler manifest from the cluster-autoscaler-<version> release tag that matches the ISO's Kubernetes minor version, and bundle that release's image.
• Pin the CCM to a release tag (v1.2.0 or later) and bundle the image of that tag.
• Allow both to be overridden when building the ISO.
• Write a file into the ISO that lists what it contains.
• Use curl -f so a failed download stops the build.