merge fix/secret-adoption-ownership (`1ed76ca24f`) #89

Merged

pipeline-bot merged 1 commit from fix/secret-adoption-ownership into trunk

2026-07-27 18:07:40 +00:00

pipeline-bot commented

2026-07-27 18:00:34 +00:00

Contributor

No description provided.

pipeline-bot added 1 commit

2026-07-27 18:00:36 +00:00

fix(secrets): require positive ownership evidence to adopt a destination

pipeline/ci CI green v1ed76ca24f87

Details

1ed76ca24f

destination.overwrite exists so an operator can deliberately take over a
Secret it did not create. The guard around it drifted in two ways.

First, "reclaim stale ownerless destinations" made a Secret adoptable
when it carried a COMPLETE set of operator ownership labels but a
different vso-ownerRefUID, on the theory that a missing ownerReference
means the previous resource is gone. It does not: ownerReferences are
routinely absent after a --cascade=orphan delete, an etcd restore, or a
write by a version that never set them. The operator cannot tell a
replaced resource from a live one, because it never looks the UID up. So
one OpenBaoDynamicSecret could take a live destination away from
another; the loser then fails its own ownership check, latches Degraded,
and has no path back. Any owner label that is not ours is now a refusal.

Second, adoption replaced the destination's labels and annotations
outright. Taking over a Secret's DATA is not a licence to erase the
bookkeeping other systems keep on the object — Helm release metadata,
ArgoCD tracking, kubectl's last-applied — which silently detaches it
from whatever manages it. Adoption now seeds from what is already there
and overlays the configured set. Secrets we already own keep the old
replace-from-empty behavior, because for those the configured set is
authoritative and drift correction depends on dropped labels actually
being dropped.

Adoption is also no longer silent: it logs at Info, since it ownerRef's
someone else's object to the syncable-secret and thereby enrolls it in
that resource's garbage collection.

The test that asserted the foreign-UID steal was intended behavior is
inverted, and a new test covers metadata preservation.

pipeline-bot force-pushed fix/secret-adoption-ownership from 1ed76ca24f

pipeline/ci CI green v1ed76ca24f87

Details

to 300bfd723c

pipeline/ci CI green v300bfd723c2b

Details

2026-07-27 18:00:57 +00:00

Compare

pipeline-bot merged commit e7dbe91a18 into trunk

2026-07-27 18:07:40 +00:00

pipeline-bot referenced this pull request from a commit

2026-07-27 18:07:41 +00:00