Split appcred finalizer management#901
Conversation
The AC finalizer management is now split into two phases: * Early phase: adds consumer finalizer to the new AC secret immediately (protects it from premature revocation) * Late phase: removes consumer finalizer from the old AC secret only after `AllSubConditionIsTrue()` This prevents a race condition where rapid AC rotations could revoke credentials still in use by running pods. Signed-off-by: Veronika Fisarova <vfisarov@redhat.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Deydra71 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 5m 21s |
|
recheck Looks like dataplane deployment timed out |
1 participant
Following the discussion in watcher-operator the AC finalizer management is now split into two phases:
AllSubConditionIsTrue()This prevents a race condition where rapid AC rotations could revoke credentials still in use by running pods. The same pattern is implemented in all service operators with application credential support.