Rancher Wins v0.5.0 upgrade endlessly fails?

[bsnuggs1]

Has anyone ran into an issue where the system-upgrade-controller triggers an upgrade of rancher/wins:v0.5.0, but never completes it? I see several pods on each windows node where it's error'd while attempting to apply an upgrade. When I inspect the pods of the rancher/wins upgrade, I see the following:

INFO[2025-05-21T13:07:51-04:00] Building Initial State...                    
FATA[2025-05-21T13:07:51-04:00] could not build initial state for rancher-wins: could not open rancher-wins service while building initial state: rancher-wins service does not exist 

From looking at the jobs that get created, it seems like the job is missing a few details to accomplish the upgrade. Since I can't edit the jobs directly, I cloned it to try and see if I could get it to run to completion..

1. It is missing the correct securityContext to access host services. Adding the following to spec (or to the container) should resolve the issue:

securityContext:
  windowsOptions:
    hostProcess: true
    runAsUserName: "NT AUTHORITY\\Local service"

2. After trying to add the above, it seems there are more issues because now the following issue occurs:

INFO[2025-05-21T13:26:50-04:00] Building Initial State...                    
FATA[2025-05-21T13:26:50-04:00] could not build initial state for rancher-wins: could not open rancher-wins config while building initial state: could not decode config: open c:/etc/rancher/wins/config: Access is denied. 

Which feels like a bug since it would need to access that file from c:/host/etc/rancher/wins/config instead

How can I modify the controller that keeps creating these jobs? Or should I just do a manual upgrade instead?

[brandond]

This would best be asked in https://github.com/rancher/system-agent or https://github.com/rancher/rancher. The SUC itself is not responsible for anything done by the upgrade image itself. All it does is schedule jobs based on the plan.

[bsnuggs1]

Ok, thank you. I have posted this here on the rancher repository instead.