Upgrade 1.7.2 to 1.7.6 fails: open /usr/install/amd64/vmlinuz: no such file or directory

KarstenB commented 3 weeks ago

Bug Report

The upgrade with:

talosctl upgrade --nodes X.X.X.X --preserve --image factory.talos.dev/installer-secureboot/9391e38dae30073c5fb8afe975ce1ed73865bac1237e72f71ca127809584a050:v1.7.6

fails with:

    * X.X.X.X: 1 error(s) occurred:
    sequence error: sequence failed: error running phase 10 in upgrade sequence: task 1/1: failed, task "upgrade" failed: exit code 1

Logs

I was able to capture a screenshot from KVM (is there a better way to get access to this log?): talos_upgrade_failure

Environment

Talos version:

❯ talosctl version --nodes X.X.X.X
Client:
Tag:         v1.7.6
SHA:         ae67123a
Built:
Go version:  go1.22.5
OS/Arch:     darwin/arm64
Server:
NODE:        147.54.110.217
Tag:         v1.7.2
SHA:         f876025b
Built:
Go version:  go1.22.3
OS/Arch:     linux/amd64
Enabled:     RBAC

Kubernetes version:

❯ kubectl version 
Client Version: v1.29.3
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.30.1

Platform: Bare metal AMD64

smira commented 3 weeks ago

You can't upgrade non-SecureBoot system to use SecureBoot and vice versa.

See documentation.

KarstenB commented 3 weeks ago

Ahh, thanks a lot. That explains why it worked when I used the non secure-boot version!

steverfrancis commented 3 weeks ago

@smira how did oyu know the running system was not secureboot (from the above)?

smira commented 3 weeks ago

It's not obvious, but the installer did not detect a UKI-based system, so it tried to use artifacts for normal boot, so the system is not SecureBooted, and not using UKI.

frezbo commented 2 weeks ago

@smira how did oyu know the running system was not secureboot (from the above)?

you can do talosctl get securitystate to check if the system is securebooted or not

siderolabs / talos