Repository navigation
Terminating resources held by a finalizer keep being served #11
Description
Problem
Sources are built from every listed object without a DeletionTimestamp check (reconciler.go#L71-L82). Credential Secrets aren't checked either.
Reproduce
An APIKey with finalizer example.com/hold is served; after kubectl delete it is Terminating, yet further reconciles still serve its key_hash with Programmed=True until the finalizer is released.
Impact
Deleting an APIKey to revoke it leaves the key working while it is Terminating. Common sources: --cascade=foreground (usually seconds), custom tooling, or a stuck finalizer.
Scores
| Reproducibility | Likelihood | Severity | Existing mitigations | Detectability | Test coverage | Fix cost vs benefit |
|---|---|---|---|---|---|---|
| 10 | 2 | 6 | 3 | 3 | 2 | 9 |
Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).
Fix
Skip objects with DeletionTimestamp != nil when building sources and when patching status, and skip terminating Secrets as credential sources. A terminating object then renders exactly as it will once deleted.
Tests to add
An envtest with a foreign finalizer: delete, reconcile, assert the key is gone from the file.
Activity
coderabbitai commentedon Nov 10, 2026
🔗 Related PRs
#3 - Revert "feat: first version of aisix-controller" [open]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!