Add transport secret consumer finalizer for credential rotation#712
Add transport secret consumer finalizer for credential rotation#712lmiccini wants to merge 3 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: lmiccini The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 10m 20s |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 14m 49s |
|
recheck |
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/infra-operator#606 is needed. |
lmiccini
force-pushed
the
transport-secret-consumer-finalizer
branch
from
329b72e to
8c5e1ce
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 9m 55s |
lmiccini
force-pushed
the
transport-secret-consumer-finalizer
branch
2 times, most recently
from
3a128ea to
724221b
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 11m 07s |
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/infra-operator#606 is needed. |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 13m 38s |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 13m 22s |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 13m 31s |
lmiccini
force-pushed
the
transport-secret-consumer-finalizer
branch
4 times, most recently
from
11752b8 to
eb1d9b5
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 10m 02s |
lmiccini
force-pushed
the
transport-secret-consumer-finalizer
branch
from
eb1d9b5 to
ed60da3
Compare
Add consumer finalizer management for transport URL secrets, modeled after the existing ApplicationCredential consumer finalizer pattern. This ensures the TransportURL controller waits for all consumers to roll out with new credentials before releasing old RabbitMQ users during rotation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
lmiccini
force-pushed
the
transport-secret-consumer-finalizer
branch
from
ed60da3 to
8802603
Compare
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Replace inline isTransportRotation guard with shared FinalizeTransportSecretRotation helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Merge Failed. This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset. |
Point lib-common at fix-createorpatch-readiness branch which fixes false-positive readiness after CreateOrPatch due to informer cache lag. Without this fix, statefulset/deployment IsReady can return true on stale cached data where Generation == ObservedGeneration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Merge Failed. This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset. |
|
@lmiccini: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Add consumer finalizer management for transport URL secrets, modeled
after the existing ApplicationCredential consumer finalizer pattern.
This ensures the TransportURL controller waits for all consumers to
roll out with new credentials before releasing old RabbitMQ users
during rotation.
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com
Depends-on: openstack-k8s-operators/infra-operator#606