Repository navigation
Fix double-minted secret at first provision - #7
Merged
Merged
Conversation
First provisioning of a serviceAccount-enabled access minted two keys about a second apart and revoked the first, stranding any consumer that had read the Secret in between (11 of 19 provisionings in one project; a gateway pod served a lapsed token for hours with the access reporting Ready=True). The reconciler's Secret write and status patch both re-enqueue the access, so a second reconcile always follows the first mint within a second. ensureAccessKey then verified the Secret's key against keys.list, and the listing - eventually consistent - had not caught up yet. The code read that as "revoked out of band", minted a replacement, and the reconciler dutifully revoked the key it had just handed out. A revoke is irreversible, so it must rest on positive evidence. The Secret's key is now reused unless it does not parse, names another identity, or the listing shows it expired. Absence from the listing no longer triggers anything. The consequence is that a key deleted server-side is no longer replaced automatically; the rotation runbook becomes "delete the Secret", which mints a fresh key and, through the existing replaced-principal path, revokes the previous one. SPEC, the driver docs and the example README are updated accordingly. The fake IAM gains an "unlisted" set so the lifecycle test covers the lag; it fails on the previous code with the second key minted. Release pin bumped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
When GrantAccess returns a new principal the reconciler revokes the previous one, which is the right thing for a lost or rotated Secret - and invisible: the access stays Ready=True, the Secret holds a valid key, and nothing in the controller log names the namespace. The stranded gateway pod in ISSUE_first_provisioning_mints_two_keys_and_revokes_the_one_a_consumer_read.md was only found through the IAM audit log. A Normal PrincipalReplaced event now names the revoked and the current principal and tells the operator to restart consumers that loaded the Secret once. Steady-state reconciles emit nothing; the test covers both. Release pin bumped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.