chideat / valkey-operator / 29330046213

22%

main: 24%

Pull #99

github

fix: only finalize the password secret once the user exists

The secret finalizer is added while reconciling the password secret, before
Handler.Do has created the user on the instance, but the User's own finalizer is
only added after Handler.Do succeeds. For an instance that never becomes ready
the two never balance: Handler.Do returns "instance is not ready" and requeues,
so the secret carries a finalizer while the User carries none.

Deleting the namespace then strands the secret. The User has no finalizer, so it
is removed immediately, and with it the only controller that would ever run the
cleanup path that drops the secret's finalizer. The secret is never reclaimed
and the namespace stays in Terminating forever.

Reproduced with an instance whose pods can never schedule: every User was gone
while failover-acl-<name>-operator-secret still held buf.red/user-finalizer, and
the namespace only released after the finalizer was patched out by hand.

The finalizer exists to keep the password readable until the user is dropped
from the instance, so it is not needed until that user exists. Add it once the
User reaches Ready, and only after the User itself is finalized -- that ordering
is the invariant: a secret finalizer set while the User has none is
unreclaimable, whereas a User finalizer with no secret finalizer is safe, as the
cleanup path reclaims every secret it owns. An instance that never becomes ready
now ends with no finalizers at all and is garbage collected normally.

Also drop the ContainsFinalizer clause from the secret update condition. It
guarded adding the finalizer; with that moved out, it would otherwise fire an
update on every reconcile once the finalizer was present.

Verified on a live cluster: an instance left unschedulable produces its acl
secret with no finalizer, and deleting the namespace now completes instead of
hanging. Note that secrets already stranded by an earlier operator still need
the finalizer removed by hand -- nothin... (continued)

0 of 22 new or added lines in 2 files covered. (0.0%)

4610 of 20595 relevant lines covered (22.38%)

0.26 hits per line