Reconcile cloud-provider InstanceMetadata.AdditionalLabels periodically

What would you like to be added?

The cloud node controller should periodically reconcile node labels returned through cloudprovider.InstanceMetadata.AdditionalLabels for already initialized Nodes.

The reconciliation should:

• add labels that are missing from the Node;
• update labels whose values differ from the current instance metadata;
• preserve unrelated Node labels;
• continue rejecting labels in Kubernetes-reserved namespaces;
• not remove labels that are no longer returned by the cloud provider.

A proposed implementation is available in:

https://github.com/kubernetes/kubernetes/pull/141616

Provider-side implementation:

https://github.com/kubernetes/cloud-provider-openstack/pull/3166

Previous implementation attempts:

https://github.com/kubernetes/kubernetes/pull/130888 https://github.com/kubernetes/kubernetes/pull/131096

Why is this needed?

InstanceMetadata.AdditionalLabels are currently applied only during the initial synchronization of a Node carrying the external cloud-provider taint.

Consequently, labels introduced by a newer cloud provider are not added to already initialized Nodes, manually removed labels are not restored, and changed values remain stale.

One example is the OpenStack hostId, which identifies the physical compute host within a project. An OpenStack operator may live-migrate an instance while draining a hypervisor for maintenance. In this case, the provider returns a new hostId, but the existing Node label is not updated.

For InstancesV2 implementations, the cloud node controller already periodically calls InstanceMetadata(). Reconciling AdditionalLabels therefore does not require an additional cloud-provider API request.

Existing Pods are not automatically rescheduled when a topology label changes. Updating the label still makes the current placement observable and ensures newly scheduled Pods use the current topology information.

/sig cloud-provider /area cloudprovider