zalando / postgres-operator / 31506680936

44%

push

github

Skip owner references on user secrets when secret deletion is disabled (#3165)

* Skip owner references on user secrets when secret deletion is disabled

Kubernetes garbage-collects owner-referenced secrets as soon as the
owning Postgresql resource is deleted, regardless of the operator's
own EnableSecretsDeletion check in Delete() (which only guards the
operator's explicit deleteSecrets() call, not GC). This made
enable_secrets_deletion=false ineffective whenever
enable_owner_references was also enabled, since GC removed the
credential secrets anyway.

Now the generated secrets are not removed when
enable_owner_references: true, enable_secrets_deletion: false.

* Document skip-owner-refs on user secrets when deletion disabled

- refresh inline comment in generateSingleUserSecret
- extend enable_owner_references / enable_secrets_deletion docs in
  operator_parameters.md to describe the interaction
- clarify in operator_parameters.md that the protection takes effect
  on the cluster's next sync after the setting is applied
- add third exception in administrator.md "Owner References and Finalizers"
- add TestGenerateSingleUserSecret_OwnerReferences covering all four
  flag combinations plus the cross-namespace cases

---------

Co-authored-by: Serdar Dalgıç <sd@serdardalgic.org>

2 of 2 new or added lines in 1 file covered. (100.0%)

6831 of 15613 relevant lines covered (43.75%)

21.86 hits per line