release-1.17: prepare v1.17.1

.github/workflows/integrate-cluster-cmd.yaml

@@ -90,6 +90,8 @@ jobs:
         # if: always()
         run: |
           docker exec tiup-cluster-control bash /tiup-cluster/tests/tiup-cluster/script/pull_log.sh /tiup-cluster/logs
+          mkdir -p ./logs
+          docker cp tiup-cluster-control:/tiup-cluster/logs/. ./logs/
 
       - name: Detect error log
         if: ${{ failure() }}
@@ -103,7 +105,7 @@ jobs:
         uses: actions/upload-artifact@v6
         with:
           overwrite: true
-          name: component_logs
+          name: component_logs-${{ matrix.cases }}
           path: ./logs
 
       - name: Output cluster debug log

.github/workflows/integrate-cluster-scale.yaml

@@ -91,6 +91,8 @@ jobs:
         # if: always()
         run: |
           docker exec tiup-cluster-control bash /tiup-cluster/tests/tiup-cluster/script/pull_log.sh /tiup-cluster/logs
+          mkdir -p ./logs
+          docker cp tiup-cluster-control:/tiup-cluster/logs/. ./logs/
 
       - name: Detect error log
         if: ${{ failure() }}
@@ -103,7 +105,7 @@ jobs:
         uses: actions/upload-artifact@v6
         with:
           overwrite: true
-          name: cluster_logs
+          name: cluster_logs-${{ matrix.cases }}
           path: ./logs
 
       - name: Output cluster debug log

CHANGELOG.md

@@ -1,5 +1,14 @@
 TiUP Changelog
 
+## [1.17.1] 2026-09-08
+
+### Fixes
+
+- `tiup-cluster` fix Grafana dashboard datasource replacement when using VictoriaMetrics (#2732, @Defined2014)
+- `tiup-cluster` collect node_exporter metrics on dedicated TiDB Dashboard hosts (#2734, @mayjiang0203)
+- `tiup-cluster` preserve shared exporter directories and systemd units when destroying a cluster with `ignore_exporter: true` (#2737, @Smityz, @ekexium)
+- `tiup-cluster` prevent concurrent TLS certificate distribution from copying an empty CA certificate and blocking component startup (#2738, @ekexium)
+
 ## [1.17.0] 2026-07-27
 
 ### New Features

docker/node/Dockerfile

@@ -1,19 +1,17 @@
 # Based on the deprecated `https://github.com/tutumcloud/tutum-debian`
-FROM golang:1.24-bullseye
+FROM golang:1.24-bookworm
 
 # Use mirrors for poor network...
 #RUN sed -i 's/deb.debian.org/mirrors.aliyun.com/g' /etc/apt/sources.list && \
 #    sed -i 's/security.debian.org/mirrors.aliyun.com/g' /etc/apt/sources.list
 
 # Install packages
-# JRE 11 is installed for tispark testing, a tispark node could be started
-# with Java 11, but is not going to work properly. However, we don't test
-# for SQL in CI, so it's ok to use Java 11 instead of Java 8.
 RUN apt-get update && \
     apt-get -y install \
         dos2unix \
         openssh-server \
-        openjdk-11-jre-headless \
+        systemd systemd-sysv \
+        psmisc \
         sudo vim \
         iproute2 \
         && \

pkg/cluster/operation/destroy.go

@@ -58,7 +58,7 @@ func Destroy(
 		for _, inst := range insts {
 			instCount[inst.GetManageHost()]--
 			if instCount[inst.GetManageHost()] == 0 {
-				if cluster.GetMonitoredOptions() != nil {
+				if cluster.GetMonitoredOptions() != nil && !inst.IgnoreMonitorAgent() {
 					if err := DestroyMonitored(ctx, inst, cluster.GetMonitoredOptions(), options.OptTimeout, cluster.BaseTopo().GlobalOptions.SystemdMode); err != nil && !options.Force {
 						return err
 					}

pkg/cluster/operation/destroy_test.go

@@ -0,0 +1,128 @@
+// Copyright 2026 PingCAP, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package operator
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pingcap/tiup/pkg/cluster/ctxt"
+	"github.com/pingcap/tiup/pkg/cluster/spec"
+	logprinter "github.com/pingcap/tiup/pkg/logger/printer"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+type destroyExecutor struct {
+	commands []string
+}
+
+func (e *destroyExecutor) Execute(_ context.Context, cmd string, _ bool, _ ...time.Duration) ([]byte, []byte, error) {
+	e.commands = append(e.commands, cmd)
+	// Empty ss output models stopped ports, so an unexpected exporter cleanup
+	// is caught by the assertions without waiting for a timeout.
+	return nil, nil, nil
+}
+
+func (*destroyExecutor) Transfer(_ context.Context, _, _ string, _ bool, _ int, _ bool) error {
+	return nil
+}
+
+func TestDestroyIgnoreExporter(t *testing.T) {
+	for _, tc := range []struct {
+		name              string
+		ignoreExporter    bool
+		multipleInstances bool
+		force             bool
+	}{
+		{name: "shared", ignoreExporter: true},
+		{name: "shared_multiple_instances", ignoreExporter: true, multipleInstances: true},
+		{name: "shared_force", ignoreExporter: true, force: true},
+		{name: "managed"},
+		{name: "managed_multiple_instances", multipleInstances: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			topology := fmt.Sprintf(`
+global:
+  user: tidb
+  deploy_dir: /tidb-deploy
+  data_dir: /tidb-data
+monitored:
+  deploy_dir: /tidb-deploy/monitor-9100
+  data_dir: /tidb-data/monitor-9100
+  log_dir: /tidb-log/monitor-9100
+pd_servers:
+  - host: 192.0.2.1
+    ignore_exporter: %t
+`, tc.ignoreExporter)
+			if tc.multipleInstances {
+				topology += fmt.Sprintf(`
+tidb_servers:
+  - host: 192.0.2.1
+    ignore_exporter: %t
+`, tc.ignoreExporter)
+			}
+			var topo spec.Specification
+			require.NoError(t, yaml.Unmarshal([]byte(topology), &topo))
+
+			exec := &destroyExecutor{}
+			ctx := ctxt.New(context.Background(), 1, logprinter.NewLogger(""))
+			inner := ctxt.GetInner(ctx)
+			inner.SetExecutor("192.0.2.1", exec)
+			inner.PublicKeyPath = filepath.Join(t.TempDir(), "id_rsa.pub")
+			require.NoError(t, os.WriteFile(inner.PublicKeyPath, []byte("ssh-ed25519 test-key"), 0600))
+
+			require.NoError(t, Destroy(ctx, &topo, Options{Force: tc.force}))
+
+			// Destroy must still remove the cluster's own components.
+			require.Contains(t, exec.commands, "rm -rf /etc/systemd/system/pd-2379.service;")
+			if tc.multipleInstances {
+				require.Contains(t, exec.commands, "rm -rf /etc/systemd/system/tidb-4000.service;")
+			}
+
+			wantDeletes := 1
+			if tc.ignoreExporter {
+				wantDeletes = 0
+			}
+			for _, path := range []string{
+				"/tidb-deploy/monitor-9100",
+				"/tidb-data/monitor-9100",
+				"/tidb-log/monitor-9100",
+				"/etc/systemd/system/node_exporter-9100.service",
+				"/etc/systemd/system/blackbox_exporter-9115.service",
+			} {
+				deletes := 0
+				for _, cmd := range exec.commands {
+					if strings.HasPrefix(cmd, "rm -rf ") && strings.Contains(cmd, path) {
+						deletes++
+					}
+				}
+				require.Equal(t, wantDeletes, deletes, "deletions of %s: %v", path, exec.commands)
+			}
+
+			portChecks := 0
+			for _, cmd := range exec.commands {
+				if cmd == "ss -ltn" {
+					portChecks++
+				}
+			}
+			require.Equal(t, 2*wantDeletes, portChecks, "each managed exporter port is checked once")
+		})
+	}
+}

pkg/cluster/spec/grafana.go

@@ -374,13 +374,16 @@ func (i *GrafanaInstance) initDashboards(ctx context.Context, e ctxt.Executor, s
 	}
 
 	// Deal with the cluster name and datasource
+	// Replace literal dashboard placeholders first. The datasource name can contain
+	// "test-cluster" (for example, "test-cluster-vm"), so replacing these literals
+	// after datasource placeholders would rewrite the generated name a second time.
 	for _, cmd := range []string{
+		`find %s -type f -exec sed -i 's/test-cluster/%s/g' {} \;`,
+		`find %s -type f -exec sed -i 's/Test-Cluster/%s/g' {} \;`,
 		`find %s -type f -exec sed -i 's/\${DS_.*-CLUSTER}/%s/g' {} \;`,
 		`find %s -type f -exec sed -i 's/DS_.*-CLUSTER/%s/g' {} \;`,
 		`find %s -type f -exec sed -i 's/\${DS_LIGHTNING}/%s/g' {} \;`,
 		`find %s -type f -exec sed -i 's/DS_LIGHTNING/%s/g' {} \;`,
-		`find %s -type f -exec sed -i 's/test-cluster/%s/g' {} \;`,
-		`find %s -type f -exec sed -i 's/Test-Cluster/%s/g' {} \;`,
 	} {
 		cmd := fmt.Sprintf(cmd, dashboardsDir, datasourceName)
 		_, stderr, err := e.Execute(ctx, cmd, false)

pkg/cluster/spec/grafana_test.go

@@ -282,6 +282,18 @@ func TestVictoriaMetricsDefaultDatasource(t *testing.T) {
 	err = os.MkdirAll(binDir, 0755)
 	require.NoError(t, err)
 
+	datasourceName := "test-cluster-vm"
+	dashboardReplacements := []struct {
+		commandPattern string
+		placeholder    string
+	}{
+		{`s/test-cluster/`, "test-cluster"},
+		{`s/Test-Cluster/`, "Test-Cluster"},
+		{`s/\${DS_.*-CLUSTER}/`, "${DS_TEST-CLUSTER}"},
+		{`s/DS_.*-CLUSTER/`, "DS_TEST-CLUSTER"},
+		{`s/\${DS_LIGHTNING}/`, "${DS_LIGHTNING}"},
+		{`s/DS_LIGHTNING/`, "DS_LIGHTNING"},
+	}
 	// Create a mock for the execute function to handle the dashboard copy command
 	origExecutor := &mockExecutor{
 		executeFunc: func(ctx context.Context, cmd string, sudo bool, timeouts ...time.Duration) ([]byte, []byte, error) {
@@ -297,31 +309,29 @@ func TestVictoriaMetricsDefaultDatasource(t *testing.T) {
 					return nil, nil, err
 				}
 			} else if strings.Contains(cmd, "sed") {
-				// Handle the sed command to replace datasource references
+				// Handle each sed command using the same replacement order as initDashboards.
 				files, err := os.ReadDir(dashboardsDir)
 				if err != nil {
 					return nil, nil, err
 				}
 
 				for _, file := range files {
 					if strings.HasSuffix(file.Name(), ".json") {
-						content, err := os.ReadFile(filepath.Join(dashboardsDir, file.Name()))
+						filePath := filepath.Join(dashboardsDir, file.Name())
+						content, err := os.ReadFile(filePath)
 						if err != nil {
 							return nil, nil, err
 						}
 
-						// Replace datasource references - simulating what sed would do
-						modifiedContent := strings.ReplaceAll(string(content),
-							`"DS_TEST-CLUSTER"`,
-							fmt.Sprintf(`"DS_%s-VM"`, strings.ToUpper("test-cluster")))
-						modifiedContent = strings.ReplaceAll(modifiedContent,
-							`"text": "test-cluster"`,
-							fmt.Sprintf(`"text": "%s-vm"`, "test-cluster"))
-						modifiedContent = strings.ReplaceAll(modifiedContent,
-							`"value": "test-cluster"`,
-							fmt.Sprintf(`"value": "%s-vm"`, "test-cluster"))
-
-						err = os.WriteFile(filepath.Join(dashboardsDir, file.Name()), []byte(modifiedContent), 0644)
+						modifiedContent := string(content)
+						for _, replacement := range dashboardReplacements {
+							if strings.Contains(cmd, replacement.commandPattern) {
+								modifiedContent = strings.ReplaceAll(modifiedContent, replacement.placeholder, datasourceName)
+								break
+							}
+						}
+
+						err = os.WriteFile(filePath, []byte(modifiedContent), 0644)
 						if err != nil {
 							return nil, nil, err
 						}
@@ -335,7 +345,11 @@ func TestVictoriaMetricsDefaultDatasource(t *testing.T) {
 	// Create a sample dashboard file with datasource references
 	dashboardContent := `{
 		"annotations": {
-			"list": []
+			"list": [
+				{
+					"datasource": "${DS_TEST-CLUSTER}"
+				}
+			]
 		},
 		"editable": true,
 		"fiscalYearStartMonth": 0,
@@ -408,8 +422,15 @@ func TestVictoriaMetricsDefaultDatasource(t *testing.T) {
 	content, err := os.ReadFile(dashboardFile)
 	require.NoError(t, err)
 
-	// Verify VM datasource was used
-	assert.Contains(t, string(content), `"DS_TEST-CLUSTER-VM"`)
+	// Verify every dashboard reference uses the provisioned VM datasource name
+	// without rewriting it to test-cluster-vm-vm.
+	assert.Contains(t, string(content), `"datasource": "test-cluster-vm"`)
+	assert.Contains(t, string(content), `"name": "test-cluster-vm"`)
 	assert.Contains(t, string(content), `"text": "test-cluster-vm"`)
 	assert.Contains(t, string(content), `"value": "test-cluster-vm"`)
+	assert.NotContains(t, string(content), "test-cluster-vm-vm")
+
+	dsContent, err := os.ReadFile(filepath.Join(deployDir, "provisioning", "datasources", "datasource.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(dsContent), "name: test-cluster-vm")
 }

pkg/cluster/spec/monitoring.go

@@ -255,6 +255,17 @@ func (i *MonitorInstance) handleRemoteWrite(spec *PrometheusSpec, monitoring *Pr
 	}
 }
 
+func addDashboardScrapeHosts(uniqueHosts set.StringSet, topoHasField func(string) (reflect.Value, bool)) {
+	servers, found := topoHasField("DashboardServers")
+	if !found {
+		return
+	}
+	for idx := 0; idx < servers.Len(); idx++ {
+		dashboard := servers.Index(idx).Interface().(*DashboardSpec)
+		uniqueHosts.Insert(dashboard.Host)
+	}
+}
+
 // InitConfig implement Instance interface
 func (i *MonitorInstance) InitConfig(
 	ctx context.Context,
@@ -465,6 +476,9 @@ func (i *MonitorInstance) InitConfig(
 			cfig.AddDMWorker(host, uint64(port))
 		}
 	}
+	// Keep this out of the uniqueHosts loops above: another if+for would
+	// push InitConfig over revive's cognitive-complexity limit of 110.
+	addDashboardScrapeHosts(uniqueHosts, topoHasField)
 
 	if monitoredOptions != nil {
 		for host := range uniqueHosts {