Leader freshness (runtime-secret tracking + JWKS refresh) #9

Merged

ginjiruu merged 2 commits from feat/leader-freshness into master

2026-09-14 12:27:10 +00:00

ginjiruu commented

2026-09-14 03:26:40 +00:00

Owner

Closes #5

Implements issue #5 — Leader freshness (runtime-secret tracking + JWKS refresh).

What

Referenced-Secret watch (the new behaviour): the OauthClient controller now .Watches(Secrets), fanning a Secret event out to the Clients that reference it (Builder.SecretReferencers). Add/delete of a referenced Secret rebuilds the Registry promptly — the secretReady flag and the CRD Degraded status flip without waiting for the next TTL refresh (the gap the code review of #3 deferred to this ticket). Unreferenced Secrets produce no requests (no over-triggering).
JWKS refresh pins (end-to-end through a real manager, per spec #1's envtest seam): re-fetch on a CRD change and on the RefreshLoop TTL (no CRD change) re-writes the managed Registry Secret with the fresh keys; a failed refresh (simulated IdP outage) keeps the last-good keys, with the App staying in the Registry and Available (ADR-0006; the per-replica 5xx side is untouched and leader-independent).

Testing

Envtest, one shared manager (controller-runtime's controller-name registry is process-global, so per-spec managers with the production name collide) with the reconciler's Builder swapped per spec; RefreshLoop run as the same runnable cmd/main.go registers.
New specs: secret delete → secretReady=false + Degraded with no RefreshLoop and no CRD change (provably the watch); secret recreate → secretReady=true + Available; JWKS v1→v2 on CRD change; JWKS v1→v2 on the TTL; outage → refresh attempts still happen, last-good (v1) keys kept, App Available.
GOTOOLCHAIN=go1.26.0 make lint / make test: clean; go test -race on the touched package: clean.

No RBAC or generated-file changes (the secrets list/watch verb was already granted by the pre-existing marker).

Closes #5 Implements issue #5 — Leader freshness (runtime-secret tracking + JWKS refresh). ## What - **Referenced-Secret watch** (the new behaviour): the `OauthClient` controller now `.Watches(Secrets)`, fanning a Secret event out to the Clients that reference it (`Builder.SecretReferencers`). Add/delete of a referenced Secret rebuilds the Registry promptly — the `secretReady` flag and the CRD `Degraded` status flip without waiting for the next TTL refresh (the gap the code review of #3 deferred to this ticket). Unreferenced Secrets produce no requests (no over-triggering). - **JWKS refresh pins** (end-to-end through a real manager, per spec #1's envtest seam): re-fetch on a CRD change and on the `RefreshLoop` TTL (no CRD change) re-writes the managed Registry Secret with the fresh keys; a failed refresh (simulated IdP outage) keeps the last-good keys, with the App staying in the Registry and Available (ADR-0006; the per-replica 5xx side is untouched and leader-independent). ## Testing - Envtest, one shared manager (controller-runtime's controller-name registry is process-global, so per-spec managers with the production name collide) with the reconciler's `Builder` swapped per spec; `RefreshLoop` run as the same runnable `cmd/main.go` registers. - New specs: secret delete → `secretReady=false` + Degraded with **no RefreshLoop and no CRD change** (provably the watch); secret recreate → `secretReady=true` + Available; JWKS v1→v2 on CRD change; JWKS v1→v2 on the TTL; outage → refresh attempts still happen, last-good (v1) keys kept, App Available. - `GOTOOLCHAIN=go1.26.0 make lint` / `make test`: clean; `go test -race` on the touched package: clean. No RBAC or generated-file changes (the `secrets` list/watch verb was already granted by the pre-existing marker).

ginjiruu added 2 commits

2026-09-14 03:26:40 +00:00

add leader freshness: referenced-secret watch, envtest refresh pins (ttl, crd change, last-good on outage) d7481ed56f

address review: namespaced SecretReferencers arg, mutexed stub JWKS, non-leader placeholder builder

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details