From a4ac5d112186bb5696ec0f2cd7fef26e681fd04d Mon Sep 17 00:00:00 2001
From: Javad <46030348+M-JavadHeydarpour@users.noreply.github.com>
Date: Mon, 12 Oct 2026 12:53:25 +0330
Subject: [PATCH] Fix anonymous access cleanup during cluster upgrade (#13417)

---
 roles/kubernetes/control-plane/tasks/kubeadm-setup.yml | 5 ++++-
 tests/files/ubuntu22-calico-all-in-one-upgrade.yml     | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml b/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
index d907daeb6..e2aae22b8 100644
--- a/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
@@ -226,7 +226,10 @@
 
 - name: Remove binding to anonymous user
   command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
-  when: inventory_hostname == first_kube_control_plane and remove_anonymous_access
+  when:
+    - inventory_hostname == first_kube_control_plane
+    - remove_anonymous_access
+    - not upgrade_cluster_setup
 
 - name: Create kubeadm token for joining nodes with 24h expiration (default)
   command: "{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create --config={{ kube_config_dir }}/kubeadm-config.yaml"
diff --git a/tests/files/ubuntu22-calico-all-in-one-upgrade.yml b/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
index 7fd9c17a8..1e256c31c 100644
--- a/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
+++ b/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
@@ -7,6 +7,7 @@ vm_memory: 3072
 # Kubespray settings
 auto_renew_certificates: true
 system_upgrade_autoclean: true
+remove_anonymous_access: true
 
 # Currently ipvs not available on KVM: https://packages.ubuntu.com/search?suite=focal&arch=amd64&mode=exactfilename&searchon=contents&keywords=ip_vs_sh.ko
 kube_proxy_mode: iptables