From 0e796dff149880b09339174c0ff6050857f45843 Mon Sep 17 00:00:00 2001
From: CTO <cto@basicstack.de>
Date: Sun, 6 Sep 2026 01:47:47 +0000
Subject: [PATCH] fix(os-update): accept 401/403 as /livez alive in CP reboot
 poll (DEV-566)

k3s api-server /livez on this cluster is auth-gated and returns HTTP 401
without a bearer token. The Phase E reboot poll hardcoded HTTP 200, so
every CP reboot would time out at 10 min ("api-server did not return
within 600s") even though cp-2 was actually Ready and etcd-rejoined
within ~90 s.

Any HTTP response from the api-server (200/401/403) means it is up and
serving; only network-level failures (000, connection refused) count as
"not yet back". Added --max-time 5 to keep polling snappy immediately
after the reboot when TCP may accept-then-drop.

Verified during DEV-566 cycle:
  curl -sk -o/dev/null -w '%{http_code}' https://<cp>:6443/livez -> 401
on cp-1, cp-2, cp-3 (all Ready).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../scripts/os-update/update-cp-node.sh       | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/infrastructure/scripts/os-update/update-cp-node.sh b/infrastructure/scripts/os-update/update-cp-node.sh
index 78b38d2..f161048 100755
--- a/infrastructure/scripts/os-update/update-cp-node.sh
+++ b/infrastructure/scripts/os-update/update-cp-node.sh
@@ -473,15 +473,24 @@ phase_reboot() {
   if [ "$DRY_RUN" != "1" ]; then
     local deadline=$(( $(date +%s) + REBOOT_MAX_WAIT_SECONDS ))
     local code=000
+    # /livez is auth-gated on this cluster (returns 401 without a bearer token).
+    # Any HTTP response from the api-server (200/401/403) means it is up and
+    # serving; only network-level failures (000, connection refused) count as
+    # "not yet back". curl --max-time keeps the poll cycle snappy after reboot.
     while [ $(date +%s) -lt $deadline ]; do
-      code=$(curl -sk -o /dev/null -w '%{http_code}' "https://$TARGET_HOST:6443/livez" 2>/dev/null || echo 000)
-      if [ "$code" = "200" ]; then
-        log "  $NODE api-server /livez=200"
-        break
-      fi
+      code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 5 "https://$TARGET_HOST:6443/livez" 2>/dev/null || echo 000)
+      case "$code" in
+        200|401|403)
+          log "  $NODE api-server responding (/livez HTTP $code)"
+          break
+          ;;
+      esac
       sleep 5
     done
-    [ "$code" = "200" ] || die "$NODE api-server did not return within ${REBOOT_MAX_WAIT_SECONDS}s -- escalate; check 'hcloud server describe $NODE' and Hetzner console"
+    case "$code" in
+      200|401|403) : ;;
+      *) die "$NODE api-server did not return within ${REBOOT_MAX_WAIT_SECONDS}s (last code=$code) -- escalate; check 'hcloud server describe $NODE' and Hetzner console" ;;
+    esac
   fi
 
   log "-- verify etcd cluster status from peer ($PEER_HOST) -- $NODE should be 'started'"