When any node VM of a running Kubernetes cluster isn't Running (for example one worker VM stopped, or a VM a host failure left stopped), the CKS status scanner moves the cluster to Alert. scaleKubernetesCluster only accepts Created, Running or Stopped, so it refuses every request with:
Kubernetes cluster <name> is in Alert state and can not be scaled
The CloudStack cluster-autoscaler provider scales through the same API (size to add nodes, nodeids to remove them), so autoscaling stops too. A single stopped node therefore blocks adding capacity, and also blocks removing that broken node with scaleKubernetesCluster nodeids=<vm>. This is when scaling is most needed.
The state machine matches: Alert already allows AddNodeRequested, RemoveNodeRequested, RecoveryRequested, StopRequested and DestroyRequested, but has no ScaleUpRequested or ScaleDownRequested transition.
Even with the state check removed, two more things get in the way:
After a scale-up, the worker waits until the number of Ready nodes equals the cluster's total node count. A stopped node is never Ready, so the scale-up always times out.
Removing a node runs kubectl drain on it first. On a stopped VM's NotReady node the drain waits for pod deletions that the node can never confirm, so removing the stopped node fails.
versions
Seen on 4.22 with KVM. The code is the same on main.
The steps to reproduce the bug
Create a CKS cluster with 2 or more workers and wait for it to be Running.
Stop one worker VM. The cluster goes to Alert.
scaleKubernetesCluster id=<cluster> size=<current+1>: refused, "is in Alert state and can not be scaled".
scaleKubernetesCluster id=<cluster> nodeids=<stopped worker VM>: refused the same way.
What to do about it?
Allow changing the size and removing worker nodes by nodeids while the cluster is in Alert:
add Alert -> Scaling for ScaleUpRequested and ScaleDownRequested. Scaling -> Running on success and Scaling -> Alert on failure stay as they are, and the scanner moves the cluster back to Alert if a node is still down;
after a scale-up, expect only the nodes whose VMs aren't down to be Ready;
on a scale-down by size, remove nodes whose VMs are down first;
don't drain a node whose VM is down; delete the Kubernetes node object directly.
Service offering and autoscaling changes act on every node, so they stay refused in Alert, with a message saying to recover the cluster first.
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
When one node VM of a CKS cluster is not Running, the status scanner moves the cluster to Alert. scaleKubernetesCluster refuses every request in that state, including adding nodes and removing the broken node by nodeids, so the CloudStack cluster autoscaler is also blocked. The reporter identifies the missing ScaleUpRequested and ScaleDownRequested transitions from Alert, and two further blockers: the scale-up waits for all nodes to be Ready, and removal drains a NotReady node that cannot finish draining.
📊 Assessment
Dimension
Value
Reasoning
Type
type:bug
Recovery and autoscaling are refused in a state that should allow them
Component
component:cks
CKS state machine and scale worker
Severity
Severity:Major
A single stopped node blocks scaling and autoscaling
Labels
type:bug, component:cks, Severity:Major
Coding agent
Needs more info
Fix direction is given, but the change touches the state machine, scale worker and drain logic; maintainers should confirm the design
Activity
github-actions commented on Nov 9, 2026
Warning
threat detection engine error
What happenedThe threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
The threat detection engine failed to produce results.
Review the workflow run logs for details.
🎯 Triage report
When one node VM of a CKS cluster is not Running, the status scanner moves the cluster to Alert. scaleKubernetesCluster refuses every request in that state, including adding nodes and removing the broken node by nodeids, so the CloudStack cluster autoscaler is also blocked. The reporter identifies the missing ScaleUpRequested and ScaleDownRequested transitions from Alert, and two further blockers: the scale-up waits for all nodes to be Ready, and removal drains a NotReady node that cannot finish draining.
📊 Assessment
🔗 Similar issues
- CKS: concurrent operations clobber a cluster's state, and a management server restart leaves it stuck in a transient state #14608 (related) — concurrent CKS operations clobber state; same state machine area
- CKS: node drain on scale-down and upgrade fails too easily, and a failed upgrade can't be resumed #14610 (related) — drain on scale-down and upgrade fails too easily
- CKS: scale requests without an offering (autoscaler, size, enabling autoscaling) resize every node to an outdated cluster-wide offering #14552 (related) — scale requests without an offering resize nodes to an outdated offering
💡 Notes and suggestions- Reproduction: a CKS cluster with two or more workers, stop one worker VM, then call scaleKubernetesCluster with a larger size and with nodeids.
- Any change should keep offering and autoscaling changes refused in Alert, as the reporter suggests.
Add this agentic workflow to your repoTo install this agentic workflow, run