Repository navigation
fix(gateway-endpoint): keep receipted hostnames published through transient gateway reprogramming - #11
Merged
Conversation
…nsient gateway reprogramming A gateway-fleet reprogram cycle (route replaced with a new UID while the hub Gateway briefly reports no addresses, or a route generation advancing before its parent status is current) made endpointRecordSetsForGateway return no desired EndpointRecordSet: the exact UID/generation receipt match failed, the accepted hostname was not retained without targets, and the empty desired set deleted the project-wide EndpointRecordSet. Every hostname behind that Gateway (four in the observed project) then lost its A/AAAA records until the next pass recreated the object, and resolver negative caching turned each cycle into a multi-minute outage. - A receipt for the same route UID at another generation retains the hostname while the new observation is pending. - A replacement route (same name, new UID) inherits the receipt only once all its parent refs are currently Accepted, and rebinds it even while the Gateway has no addresses. - A replacement Gateway is a new authority: the old receipt is not carried, but the current accepted binding publishes its own receipt in the same pass instead of leaving a one-reconcile delete gap. Withdrawal still requires an explicit current-generation Accepted=False, spec detachment, or route/Gateway deletion.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consumer of this controller: appthrust.dev PMC (
appthrust-dns/dns-api-controller-manager, delivered by platform internal-delivery unitdns-api).Problem
During a gateway-fleet reprogram cycle the project-wide
EndpointRecordSetforpj-af59d1dc379bwas deleted and recreated (creationTimestamp 13:44:52Z → 13:48:32Z → 13:54:01Z on 2026-09-14). All four hostnames behind that Gateway (payment.appthrust.dev among them) lost their A/AAAA records each time; resolver negative caching made every cycle a multi-minute outage.Proven pre-fix path (unit test replay of observed hub states): route replaced with a new UID while the Gateway momentarily has no addresses → exact UID/generation receipt match fails → the accepted hostname is not retained without targets →
len(targets)==0swaps hostnames for the empty retained set →desired == nil→Delete.Fix
See commit message. Withdrawal still requires an explicit current-generation
Accepted=False, spec detachment, or route/Gateway deletion; Unknown/absent conditions and apply conflicts retain the receipted hostname and existing targets.Verification
go test ./internal/go/apps/gatewayendpoint/... -count=1ok,go vetok,gofmt -lclean. New table tests replay: unknown Gateway acceptance + empty addresses, missing route parent status, route generation advanced before status is current, route replacement with new UID (receipt rebinds), update-conflict retry, and the negative case that an unreceipted new hostname is not published during address loss.Platform pin follow-up: platform#3923 carries the operator side; the edge chart/image digests from this merge will be pinned in
internal/controllers/internaldelivery/manifestsets/dns-api.jsonafterwards.