Leader freshness (runtime-secret tracking + JWKS refresh) #5

New issue

Closed

opened 2026-09-13 20:40:00 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-13 20:40:00 +00:00

Owner

Parent

Spec: Shared in-memory state model (Registry + Snapshot) — #1

What to build

The leader also (a) watches referenced-Secret add/delete and updates the Registry secretReady flag (for kubectl observability) plus the CRD Degraded status — the leader/observability side of the failure model, distinct from the replica's per-replica behaviour side; and (b) refreshes the JWKS on a TTL and on any CRD change (re-fetching via the resolve step, keeping last-good on failure) and re-writes the Registry.

Acceptance criteria

When a referenced Secret is deleted, the Registry entry's secretReady flips false and the App's CRD is marked Degraded; on recreation, secretReady flips true.
The JWKS is re-fetched on a TTL timer and on any CRD change, and the Registry is re-written with the refreshed keys.
When a refresh fetch fails, the last-good JWKS is retained (not blanked).
These are the leader's observability/status side; the per-replica 5xx behaviour (the Replica mirror ticket) remains immediate and leader-independent.

Blocked by

#3 — Registry builder (the leader's core)

## Parent Spec: Shared in-memory state model (Registry + Snapshot) — https://git.animeteamspeak.moe/lab/authz-bridge/issues/1 ## What to build The leader also (a) watches referenced-Secret add/delete and updates the Registry `secretReady` flag (for `kubectl` observability) plus the CRD `Degraded` status — the leader/observability side of the failure model, distinct from the replica's per-replica behaviour side; and (b) refreshes the JWKS on a TTL and on any CRD change (re-fetching via the resolve step, keeping last-good on failure) and re-writes the Registry. ## Acceptance criteria - [ ] When a referenced Secret is deleted, the Registry entry's `secretReady` flips false and the App's CRD is marked Degraded; on recreation, `secretReady` flips true. - [ ] The JWKS is re-fetched on a TTL timer and on any CRD change, and the Registry is re-written with the refreshed keys. - [ ] When a refresh fetch fails, the last-good JWKS is retained (not blanked). - [ ] These are the leader's observability/status side; the per-replica 5xx behaviour (the Replica mirror ticket) remains immediate and leader-independent. ## Blocked by - #3 — Registry builder (the leader's core)

ginjiruu added the

ready-for-agent

label

2026-09-13 20:40:30 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-14 03:26:40 +00:00

Leader freshness (runtime-secret tracking + JWKS refresh) #9

ginjiruu closed this issue

2026-09-14 12:27:11 +00:00

ginjiruu added this to the Shared in-memory state model milestone

2026-09-14 17:00:08 +00:00

ginjiruu referenced this issue