Repository navigation
The Kubernetes credential provider reloads its namespace policy without a restart - #2959
Open
Quentin Bisson (QuentinBisson) wants to merge 2 commits into
Conversation
The Kubernetes secrets provider read its namespace policy once at startup, so every policy edit needed a provider restart. It now rereads the file when its stat changes, which a ConfigMap volume update always causes. A file that fails to load is logged and leaves the last good policy in force, and /statusz shows the error. A malformed file still fails startup.
2 tasks done
Quentin Bisson (QuentinBisson)
marked this pull request as ready for review
October 20, 2026 12:43
…ge through one path LoadNamespaceAuthorizer now runs the same stat-and-parse as a reload, and policy returns the load error with the grants. The reload test swaps a ..data symlink as the kubelet does, so it fails if the stat stops following the link.
This was referenced Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reloading the policy without a restart came up in review on #2877. The provider read its namespace policy once at startup, so every policy edit needed a rollout restart. It now rereads the file when it changes; a file that fails to load is logged and the last good policy stays in force, shown on /statusz.
Part of #2876
AI use: AI-assisted, Claude Code wrote the change and tests; I review it before marking it ready.