sean/minio-resource-operator
Watch
1
0
Fork
You've already forked minio-resource-operator
 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity

merge fix/credential-cache-r3 (8105d6304e) #34

Merged
pipeline-bot merged 1 commit from fix/credential-cache-r3 into trunk 2026-07-28 07:27:21 +00:00
Conversation 0 Commits 1 Files changed 3 +182 -8
pipeline-bot commented 2026-07-28 07:27:16 +00:00
Contributor
Copy link
No description provided.
fix(client): key the client cache on identity, not just endpoint
All checks were successful
pipeline/ci CI green v8105d6304e7a
Details
8105d6304e
 
Factory cached MinIO clients by endpoint alone. resolveConnectionConfig
resolved the root credentials and then threw them away for keying
purposes, which is wrong in two directions.

Two resources may reach one endpoint through different root Secrets —
MinioRef.connection.rootSecretRef defaults its namespace to the
resource's own — so whichever reconciled first installed its admin
credentials for every later caller, and the operator performed one
namespace's IAM writes under another namespace's identity. Nothing
expired the entry either, so rotating a root Secret left the factory
handing out a client built from the superseded password until the
process restarted.

The key now covers endpoint, region, TLS, and a hash of the resolved
credentials. Hashed rather than stored: a cache key is not a place to
keep a plaintext admin password. credentialHash already existed for
exactly this comparison and had no callers.

This mattered more after 0.3.11 exposed MinioRef on MinioServiceAccount
and MinioUser, which widened who reaches the shared cache.

Also make SetDefaultClient thread-safe. Client is a two-word struct, so
the unsynchronized write was not atomic and a concurrent reader could
observe an Admin from the new credentials beside an S3 from the old.
The comment justified it on the grounds that readers "don't hold locks
while using the client" — that is the condition that creates the race,
not one that avoids it.
pipeline-bot deleted branch fix/credential-cache-r3 2026-07-28 07:27:21 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/minio-resource-operator!34
No description provided.