Repository navigation
Lacks of permissions leads to new node being deleted #399
Description
CCM should not be deleting nodes from the cluster - that's kubelet/apiserver job.
Steps to reproduce:
Create a cluster ( can be one node ), install linode-ccm.
When installing linode-ccm give it token with limited permissions ( not being able to list linodes ).
Try to join new k8s node to the cluster.
Expected:
Node joins and stays.
Actual:
Node joins, node object is being created.
In a second or two CCM removes node from the cluster:
I0612 12:40:49.098700 1 node_lifecycle_controller.go:163] deleting node since it is no longer present in cloud provider: dev1-cp-2.acme.com I0612 12:40:49.099228 1 event.go:389] "Event occurred" object="dev1-cp-2.acme.com" fieldPath="" kind="Node" apiVersion="" type="Normal" reason="DeletingNode" message="Deleting node dev1-cp-2.acme.com because it does not exist in the cloud provider"
--
This also prevents from creating hybrid clusters ( nodes can be outside of linode ).
At least there should be a way to disable node manager ( if I need only balancert functionality for example ).
Activity
rahulait commentedon Jun 16, 2025
We don't support running linode specific CCM with multiple clouds or across multiple regions.
Also, node-lifecycle-controller is an upstream controller in generic cloud-provider which is used by all specific implementations of CCM. That controller is removing nodes as it cannot verify if the node is part of cluster or not (due to limited permissions of linode token) and its a generic logic which removes nodes which are not supposed to be part of cluster.
https://github.com/kubernetes/cloud-provider/blob/master/controllers/nodelifecycle/node_lifecycle_controller.go#L54-L55
We don't support the usecase you are trying to achieve, but if you really want to, you can try setting relevant rbac permissions and see if that helps you. Again, its not supported and we don't know if this will work for your usecase. Feel free to remove the delete permission and see if you can make progress.
https://github.com/linode/linode-cloud-controller-manager/blob/main/deploy/chart/templates/clusterrole-rbac.yaml#L13-L15
I am not sure what you meant by balancert, maybe you meant nodebalancer. Nodebalancers only work with linode specific instances as backends need to be linode specific backends and are also tied to a single region. You won't be able to add nodes from a different cloud as backend nodes to these nodebalancers.
Denys-Janrain-L commentedon Jun 18, 2025
Adjusting the clusterrole is a hacky way to achieve what I'm suggesting, in my opinion there should be a legal/official way to supply some argument to achieve that.
I.e for a case when I run everything on Linode but don't want ccm to manage anything but NodeBalancers ( i.e no NodeManager ). Something like --disable-node-manager.