From bbcf59bde00a487be84cd3e5bcb30277947b2090 Mon Sep 17 00:00:00 2001
From: Anthony Yeh <enisoc@google.com>
Date: Tue, 12 Dec 2017 17:30:27 -0800
Subject: [PATCH] gce/upgrade.sh: Prompt if etcd version is unspecified.

We shouldn't upgrade etcd without first warning the user that some etcd
version transitions can't be undone. We don't know what version the user
currently has, so we require either an explicit version and image, or an
interactive acknowledgement of this caveat.

This is modeled after the STORAGE_MEDIA_TYPE prompt just above.
---
 cluster/gce/upgrade.sh           | 33 ++++++++++++++++++++++++++++++++
 test/e2e/framework/nodes_util.go |  4 ++++
 2 files changed, 37 insertions(+)

diff --git a/cluster/gce/upgrade.sh b/cluster/gce/upgrade.sh
index 452d8cfdf89..82ea8f9cb4b 100755
--- a/cluster/gce/upgrade.sh
+++ b/cluster/gce/upgrade.sh
@@ -537,6 +537,39 @@ if [[ -z "${STORAGE_MEDIA_TYPE:-}" ]] && [[ "${STORAGE_BACKEND:-}" != "etcd2" ]]
   fi
 fi
 
+# Prompt if etcd image/version is unspecified when doing master upgrade.
+# In e2e tests, we use TEST_ALLOW_IMPLICIT_ETCD_UPGRADE=true to skip this
+# prompt, simulating the behavior when the user confirms interactively.
+# All other automated use of this script should explicitly specify a version.
+if [[ "${master_upgrade}" == "true" ]]; then
+  if [[ -z "${ETCD_IMAGE:-}" && -z "${TEST_ETCD_IMAGE:-}" ]] || [[ -z "${ETCD_VERSION:-}" && -z "${TEST_ETCD_VERSION:-}" ]]; then
+    echo
+    echo "***WARNING***"
+    echo "Upgrading Kubernetes with this script might result in an upgrade to a new etcd version."
+    echo "Some etcd version upgrades, such as 3.0.x to 3.1.x, DO NOT offer a downgrade path."
+    echo "To pin the etcd version to your current one (e.g. v3.0.17), set the following variables"
+    echo "before running this script:"
+    echo
+    echo "# example: pin to etcd v3.0.17"
+    echo "export ETCD_IMAGE=3.0.17"
+    echo "export ETCD_VERSION=3.0.17"
+    echo
+    echo "Alternatively, if you choose to allow an etcd upgrade that doesn't support downgrade,"
+    echo "you might still be able to downgrade Kubernetes by pinning to the newer etcd version."
+    echo "In all cases, it is strongly recommended to have an etcd backup before upgrading."
+    echo
+    if [ -t 0 ] && [ -t 1 ]; then
+      read -p "Continue with default etcd version, which might upgrade etcd? [y/N] " confirm
+      if [[ "${confirm}" != "y" ]]; then
+        exit 1
+      fi
+    elif [[ "${TEST_ALLOW_IMPLICIT_ETCD_UPGRADE:-}" != "true" ]]; then
+      echo "ETCD_IMAGE and ETCD_VERSION must be specified when run non-interactively." >&2
+      exit 1
+    fi
+  fi
+fi
+
 print-node-version-info "Pre-Upgrade"
 
 if [[ "${local_binaries}" == "false" ]]; then
diff --git a/test/e2e/framework/nodes_util.go b/test/e2e/framework/nodes_util.go
index 2908d9688fa..f24f85fcc3c 100644
--- a/test/e2e/framework/nodes_util.go
+++ b/test/e2e/framework/nodes_util.go
@@ -78,6 +78,10 @@ func masterUpgradeGCE(rawV string, enableKubeProxyDaemonSet bool) error {
 			"TEST_ETCD_VERSION="+TestContext.EtcdUpgradeVersion,
 			"STORAGE_BACKEND="+TestContext.EtcdUpgradeStorage,
 			"TEST_ETCD_IMAGE=3.1.10")
+	} else {
+		// In e2e tests, we skip the confirmation prompt about
+		// implicit etcd upgrades to simulate the user entering "y".
+		env = append(env, "TEST_ALLOW_IMPLICIT_ETCD_UPGRADE=true")
 	}
 
 	v := "v" + rawV