[zijiren233]

Follow-up to #7344.

Problem

The standalone control-plane guard added in #7344 lives in the shared guest.Apply path, so it skipped control-plane hosts for both rootfs and patch image commands. Patch images are the supported mechanism for layering host-level changes (runtimes, node tooling, image-cri-shim upgrades), and their scripts already decide per host what to install or skip; on a standalone cluster those commands never ran on masters, which only received file distribution while workers executed everything.

Change

Keep the skip for rootfs mounts only. In standalone mode the rootfs image hooks are owned by the dedicated standalone lifecycle (containerd, kubelet, static control-plane pods, route controller); patch and application images keep their normal semantics:

• rootfs: control-plane hosts skipped (unchanged, dedicated lifecycle owns them)
• patch: executed on every host; scripts choose per-host behavior
• application: executed on the first master only (unchanged path)

Note this is a deliberate behavior change: every patch image now executes on standalone masters. For example an image-cri-shim upgrade patch must run there, since image-cri-shim is installed and active on standalone masters.

Validation

Standalone test cluster (3 control-plane hosts without Node objects, 2 workers, Kubernetes 1.33.6, containerd 1.7, Cilium), sealos built from this branch. sealos run of three patch images (gVisor runtime, stargz snapshotter, combined runsc-stargz handler):

• all five hosts executed the image commands (before the fix: masters received files only, zero command output)
• masters took the control-plane path of each script: runtime install skipped, RuntimeClass applied only on the host holding ~/.kube/config (runtimeclass.node.k8s.io/gvisor unchanged), other masters logged the no-kubeconfig notice
• workers were idempotent: already installed; refreshing configuration, configuration unchanged; containerd restart not needed, containerd ActiveEnterTimestamp unchanged
• regression: both workers Ready, all three RuntimeClasses present (gvisor, stargz, gvisor-stargz), runsc still absent from all control-plane hosts

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.49%. Comparing base (fa0fbc7) to head (49436d9).
⚠️ Report is 27 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7417      +/-   ##
==========================================
- Coverage   61.86%   61.49%   -0.38%     
==========================================
  Files           8        8              
  Lines         653      657       +4     
==========================================
  Hits          404      404              
- Misses        202      206       +4     
  Partials       47       47              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 says: cherry pick action finished successfully 🎉!
See: https://github.com/labring/sealos/actions/runs/40830492373