Follow-up from the kars-upgrade-flow review.
For a cluster broken by a previous buggy CLI, remaining recovery gaps:
- Context bound to one machine:
kars upgrade aborts without ~/.kars/context.json and tells you to 'run from the machine that deployed the cluster' — single point of failure for a team-operated product. Reconstruct context from a controller-owned ConfigMap (kars-system/kars-release: acrLoginServer, aksCluster, resourceGroup, foundryEndpoint, deployed release) so any authorized operator can upgrade/rollback from anywhere. This also gives version detection a visible, coupled home (vs the current 'dead' karsRelease Helm value).
- Stuck Helm release:
kars up cleans pending-install secrets; kars upgrade has no equivalent. A pending-upgrade/failed release makes helm upgrade --atomic abort with 'another operation in progress' and no in-tool unstick. Add the same cleanup / helm rollback-to-last-deployed before the atomic upgrade.
- No
--repair: add an idempotent 'put me back exactly on the version I'm supposed to be on' path (re-import current marker's images + re-apply + restart, skipping the version compare).
- Downgrade safety: a stale version marker could silently move a security runtime backwards; consider requiring an explicit, loud
--allow-downgrade.
Severity: P1/P2 (reliability/recovery).
Follow-up from the kars-upgrade-flow review.
For a cluster broken by a previous buggy CLI, remaining recovery gaps:
kars upgradeaborts without~/.kars/context.jsonand tells you to 'run from the machine that deployed the cluster' — single point of failure for a team-operated product. Reconstruct context from a controller-owned ConfigMap (kars-system/kars-release: acrLoginServer, aksCluster, resourceGroup, foundryEndpoint, deployed release) so any authorized operator can upgrade/rollback from anywhere. This also gives version detection a visible, coupled home (vs the current 'dead'karsReleaseHelm value).kars upcleanspending-installsecrets;kars upgradehas no equivalent. Apending-upgrade/failedrelease makeshelm upgrade --atomicabort with 'another operation in progress' and no in-tool unstick. Add the same cleanup /helm rollback-to-last-deployed before the atomic upgrade.--repair: add an idempotent 'put me back exactly on the version I'm supposed to be on' path (re-import current marker's images + re-apply + restart, skipping the version compare).--allow-downgrade.Severity: P1/P2 (reliability/recovery).