Avoid conflict between controller and webhook for new bindings#164
Merged
scothis merged 1 commit intoservicebinding:mainfrom Aug 24, 2022
Merged
Avoid conflict between controller and webhook for new bindings#164scothis merged 1 commit intoservicebinding:mainfrom
scothis merged 1 commit intoservicebinding:mainfrom
Conversation
Member
Author
|
Keeping in draft until the upstream reconciler-runtime release is available with the needed update. |
Member
Author
|
Will rebase on top of #167 once that lands. Trying to keep that PR free of semantic changes. |
For new ServiceBindings there's conflict where the ServiceBinding in the informer does not have the binding secret resolved yet. When it tries to update the workload with the projection, the webhook intercepts the request and re-applies the binding. However, the resolved secret for the binding is only on the local copy of the ServiceBinding being reconciled as it has not yet been written to the API Server. Because it appears to the webhook that the ServiceBinding does not have a binding secret, it removes the projection the controller is trying to add. This would be a nearly invisible annoyance except that the reconciler compares the update request sent for the workload with the value persisted caching the diff. That diff is then re-applied to the workload resource the next time the ServiceBinding is reconciled, and if the request would result in a no-op, the update is suppressed. To side-step this issue, when the name of the binding secret changes, we halt processing the remainder of the reconciler and update the status of the binding with the resolved binding secret name. When this update is received back by the informer, we continue with the reconciler. At this point the webhook will have the secret name available to it and will not undo the binding. Signed-off-by: Scott Andrews <andrewssc@vmware.com>
334f578 to
db2959e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For new ServiceBindings there's conflict where the ServiceBinding in the
informer does not have the binding secret resolved yet. When it tries to
update the workload with the projection, the webhook intercepts the
request and re-applies the binding. However, the resolved secret for the
binding is only on the local copy of the ServiceBinding being reconciled
as it has not yet been written to the API Server. Because it appears to
the webhook that the ServiceBinding does not have a binding secret, it
removes the projection the controller is trying to add.
This would be a nearly invisible annoyance except that the reconciler
compares the update request sent for the workload with the value
persisted caching the diff. That diff is then re-applied to the workload
resource the next time the ServiceBinding is reconciled, and if the
request would result in a no-op, the update is suppressed.
To side-step this issue, when the name of the binding secret changes, we
halt processing the remainder of the reconciler and update the status of
the binding with the resolved binding secret name. When this update is
received back by the informer, we continue with the reconciler. At this
point the webhook will have the secret name available to it and will not
undo the binding.
Signed-off-by: Scott Andrews andrewssc@vmware.com