merge fix/api-error-classification (2eb940bed8) #90
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/api-error-classification"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
normalizeOpenBaoAPIError is the one place allowed to read OpenBao's untyped response strings, and it matched "no default issuer", "is sealed", and "standby" at ANY status code. The sentinels it produces are load-bearing: - ErrNoDefaultIssuer makes GetRootCert and GetIntermediateCA report the certificate ABSENT rather than failing, which makes the controller generate a new CA and invalidate every chain issued from the old one. A 403 reading "permission denied: no default issuer currently configured" was therefore enough to regenerate a CA. - ErrOpenBaoSealed and ErrOpenBaoStandby feed IsOpenBaoServerNotReady, which classifyOpenBaoError checks ahead of the auth case, so an auth failure whose body happened to contain those words was retried as a dependency blip instead of surfacing. Each heuristic is now paired with the status code OpenBao actually uses for it — 400 for an unconfigured issuer, 503 for sealed, 429/473 for standby. Anything else keeps the generic API kind and the caller sees a plain error, which is the safe direction for all three. Also: stop restarting workloads for a credential that did not change. The ReReadOnRefresh horizon fed the rollout-restart decision on its own, so an allowStaticCreds secret with an unchanged password rolled every target on every refresh interval — and the destination Secret is not even rewritten in that case, since the HMAC short-circuits, so the restarted pod re-read what it already had. The decision now hinges on the credential actually changing, or on a spec change that moves the destination or path; where a re-mint does produce new material the sync reports it and the restart still happens. Extracting the decision into shouldRolloutRestart makes it testable, and left leaseReconcileDecision with a dead ForceRollout field, which is removed.Pull request closed