- Ya
- 19 Agosti 2026, 02:41 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 6faa2ea
The deploy died at "Install kubectl". Three separate faults lined up: 1. curl aborted mid-stream with (56) "decryption failed or bad record mac" — the corruption class k1m1's LAN link has produced before on transfers over ~20MB. The command carried `--retry 3`, but plain `--retry` only covers timeouts/429/5xx; a TLS read failure is not in that set, so curl never retried and gave up on the first hiccup. 2. The wget fallback could never have run. It passed `--ipv4`, which is curl's spelling — GNU wget wants `-4`/`--inet4-only` — so wget answered with a usage error every time and the step exited 1. The fallback has been dead since it was written. 3. The version came from dl.k8s.io/release/stable.txt, which floats. It had moved to v1.36.3 while both nodes run v1.35.6+rke2r1, so the deploy quietly retargeted itself on an upstream release. Pin v1.35.6 to match the control plane, drop the stable.txt lookup, add --retry-all-errors so the transient TLS aborts actually retry, and verify the binary against its published sha256 with a re-download on mismatch — silent corruption delivers the right byte count and reports success, so a digest check is the only thing that catches it. The cached-binary path is digest-checked too rather than trusted on sight. The dead wget fallback is removed. Full-reconcile drift audit before pushing (a .forgejo/ change sets FULL=true): 108/112 apply targets clean. The 4 flagged are benign — guac-bootstrap, mysql-auth-fix and nats-stream-bootstrap are deleted-then-reapplied by the workflow, and mysql-permissions-job is an immutable Job whose apply is already guarded with `|| echo`. Every `kubectl delete` target is absent except hero-hls-encode, which is delete-then-apply by design and no-ops.