release v0.5.19 (4373046ad4) #65
Loading…
Reference in a new issue
No description provided.
Delete branch "_promote/v0.5.19"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
kratosTaxonomy marked ConfigurationError as Terminal. The lib's failPath returns (ctrl.Result{}, nil) for Terminal — no requeue and no error — so controller-runtime drops the item. There is no manager SyncPeriod, and the 5m requeueReady cadence is only on the success path, so nothing re-enqueued the object afterwards. classifyKratosError maps every Kratos response that is not 404/409 (IdentityConflict) and not 401/403/408/429/5xx (APIUnreachable) to ConfigurationError. That bucket includes 400 and 422, which is how Kratos rejects a password that fails its policy — including the HaveIBeenPwned breach-list check, a live outbound call from Kratos that can fail transiently. A momentary HIBP failure therefore abandoned the KratosIdentity permanently: the identity was never created, the user could never log in, and it self-healed only if a human edited the spec. Terminal is sound only when the reason is a pure function of the CR. InvalidSpec qualifies: correcting it necessarily edits the spec, and the watch re-enqueues on that edit. ConfigurationError does not — it is a remote verdict, and no Kubernetes event fires when the remote condition clears, so there is no trigger to reconsider it. Use FixedRequeue with a 5m interval. Unlike Backoff it swallows the error, so a genuinely bad password does not produce a backoff storm or error-log spam, and the latched Degraded=ConfigurationError status stays visible — while the fixed retry guarantees the self-heal. Adds a table test asserting the disposition (InvalidSpec terminal, ConfigurationError not terminal and requeueing with a positive interval), next to the existing test that asserts 400/422 classify as ConfigurationError. Verified red against the pre-fix taxonomy.839ad8db49)' (#64) from fix/configuration-error-requeue into trunk