Fix flaky control-plane join certificate upload

Two changes to fix upload-certs timing out during control-plane join:

1. Pin kubernetesVersion in the kubeadm config template by querying
   kubeadm version -o short from the VM. Without it, every kubeadm
   subcommand fetches the latest version from dl.k8s.io.

2. Pass --config to upload-certs with a temp config that includes
   both the certificateKey and kubernetesVersion. Since --config and
   --certificate-key are mutually exclusive, the key goes in the
   config file. This prevents the remote version lookup that eats
   into kubeadm's 10s internal timeout, causing "rate: Wait(n=1)
   would exceed context deadline".

Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: alicefr

internal/cluster/init.go

@@ -8,6 +8,7 @@ import (
 	"context"
 	_ "embed"
 	"fmt"
+	"strings"
 	"text/template"
 	"time"
 
@@ -25,13 +26,15 @@ var calicoManifest []byte
 var kubeadmConfigTemplate = template.Must(template.New("kubeadm-config").Parse(kubeadmConfigTmpl))
 
 type kubeadmConfigParams struct {
-	AdvertiseAddress string
+	AdvertiseAddress  string
+	KubernetesVersion string
 }
 
 // InitOptions holds options for cluster initialization
 type InitOptions struct {
-	NodeName string
-	Timeout  time.Duration
+	NodeName          string
+	KubernetesVersion string
+	Timeout           time.Duration
 }
 
 // Init initializes a Kubernetes cluster on the control plane node
@@ -60,14 +63,23 @@ func (c *Cluster) Init(ctx context.Context, opts InitOptions) error {
 	// Create SSH client
 	sshClient := ssh.NewClientForNode(c.name, nodeName, c.logger)
 
+	// Query the exact kubeadm version from the VM so the config pins it
+	// and prevents kubeadm from doing a remote version lookup.
+	kubeVersion := opts.KubernetesVersion
+	if kubeVersion == "" {
+		if out, err := sshClient.Exec(ctx, "kubeadm version -o short"); err == nil {
+			kubeVersion = strings.TrimSpace(out)
+		}
+	}
+
 	// Create kubeadm config in container
 	c.logger.Info("Creating kubeadm config file...")
 	clusterLabel := c.name
 	if clusterLabel == "" {
 		clusterLabel = config.DefaultNetworkName
 	}
 	containerName := fmt.Sprintf("k8s-%s-%s", clusterLabel, nodeName)
-	if err := c.createKubeadmConfig(ctx, containerName, clusterIP); err != nil {
+	if err := c.createKubeadmConfig(ctx, containerName, clusterIP, kubeVersion); err != nil {
 		return fmt.Errorf("failed to create kubeadm config: %w", err)
 	}
 
@@ -188,10 +200,11 @@ func (c *Cluster) waitForCalicoCNI(ctx context.Context, sshClient *ssh.Client) e
 }
 
 // createKubeadmConfig creates the kubeadm config file in the container
-func (c *Cluster) createKubeadmConfig(ctx context.Context, containerName string, advertiseAddress string) error {
+func (c *Cluster) createKubeadmConfig(ctx context.Context, containerName string, advertiseAddress string, kubernetesVersion string) error {
 	var buf bytes.Buffer
 	if err := kubeadmConfigTemplate.Execute(&buf, kubeadmConfigParams{
-		AdvertiseAddress: advertiseAddress,
+		AdvertiseAddress:  advertiseAddress,
+		KubernetesVersion: kubernetesVersion,
 	}); err != nil {
 		return fmt.Errorf("failed to render kubeadm config: %w", err)
 	}

internal/cluster/join.go

@@ -146,7 +146,22 @@ func (c *Cluster) generateJoinCommand(ctx context.Context, cpSSHClient *ssh.Clie
 			return "", fmt.Errorf("certificate key is empty")
 		}
 
-		if _, err := cpSSHClient.Exec(ctx, fmt.Sprintf("sudo kubeadm init phase upload-certs --upload-certs --certificate-key %s", certificateKey)); err != nil {
+		// Write a temp config that includes certificateKey and
+		// kubernetesVersion, then pass --config to upload-certs.
+		// --config and --certificate-key are mutually exclusive, so the
+		// key must be in the config file. Setting kubernetesVersion
+		// prevents kubeadm from fetching it from dl.k8s.io — that
+		// remote call eats into the 10s internal timeout and causes
+		// "rate: Wait(n=1) would exceed context deadline".
+		writeCmd := fmt.Sprintf(
+			`sudo cp /etc/kubernetes/kubeadm-config.yaml /tmp/upload-certs-config.yaml && `+
+				`sudo sed -i '/^kind: InitConfiguration/a certificateKey: %s' /tmp/upload-certs-config.yaml`,
+			certificateKey)
+		if _, err := cpSSHClient.Exec(ctx, writeCmd); err != nil {
+			return "", fmt.Errorf("failed to write upload-certs config: %w", err)
+		}
+
+		if _, err := cpSSHClient.Exec(ctx, "sudo kubeadm init phase upload-certs --upload-certs --config /tmp/upload-certs-config.yaml"); err != nil {
 			return "", fmt.Errorf("failed to upload certificates: %w", err)
 		}
 

internal/cluster/kubeadm-config.yaml.tmpl

@@ -8,6 +8,7 @@ nodeRegistration:
 ---
 apiVersion: kubeadm.k8s.io/v1beta3
 kind: ClusterConfiguration
+kubernetesVersion: "{{.KubernetesVersion}}"
 controlPlaneEndpoint: "{{.AdvertiseAddress}}:6443"
 apiServer:
   certSANs: