Repository navigation
Delete and quick re-create inherits the deleted resource's served entry #14
Description
Problem
The owner index is keyed Kind/name (assemble.go#L144-L151), and render.Source carries no UID (reconciler.go#L88-L90). A resource deleted and re-created with the same name, with no reconcile in between, inherits the old entry when its new spec is rejected.
Reproduce
Re-create an APIKey with a rejected spec (or a missing Secret) within the 1 s settle window: it is Retained with the deleted object's key_hash and allowed_models. Gaps of 0, 300 and 800 ms inherit; 3 s does not. kubectl replace --force, kubectl delete -f && kubectl apply -f, and forced syncs fall in this window, as does any controller downtime.
Scores
| Reproducibility | Likelihood | Severity | Existing mitigations | Detectability | Test coverage | Fix cost vs benefit |
|---|---|---|---|---|---|---|
| 10 | 2 | 5 | 4 | 4 | 1 | 6 |
Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).
Fix
Add UID to render.Source, store it in the index ({"Kind/name": {"id": ..., "uid": ...}}), and match the served entry only on equal UID.
Tests to add
Same name with a new UID gives Rejected; the same UID still finds its entry after a display_name change.
Activity