Repository navigation
A failed Secret write or Deployment stamp leaves statuses stale #15
Description
Problem
writeSecret and the stamp return before the status loop (reconciler.go#L135-L145). No EventRecorder is wired.
Reproduce
| Failure | Status afterwards |
|---|---|
| Secret update fails | Accepted=True, Programmed=True for the previous generation |
| Deployment stamp fails | same stale True, while the Secret already holds the new spec |
| File over 1 MiB (apiserver rejects the write) | a new ProviderKey gets no conditions at all |
Impact
Status reports success; anything gating on Programmed=True passes wrongly. Only observedGeneration lag and controller logs reveal it.
Scores
| Reproducibility | Likelihood | Severity | Existing mitigations | Detectability | Test coverage | Fix cost vs benefit |
|---|---|---|---|---|---|---|
| 10 | 3 | 4 | 3 | 3 | 1 | 8 |
Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).
Fix
On a write or stamp error, still run the status loop with Programmed=False (WriteFailed or RolloutFailed with the error message), emit a Warning Event through mgr.GetEventRecorderFor, then return the error so backoff applies. Name the 1 MiB limit in the message when it is the cause.
Tests to add
Failing Secret write, failing stamp, and an oversized file.
Activity