Skip to content

fix(webhook): reject edits to spec.volumeClaimTemplates - #127

Merged
jensens merged 1 commit into
mainfrom
fix/immutable-volumeclaimtemplates
Oct 27, 2026
Merged

jensens merged 1 commit into
mainfrom
fix/immutable-volumeclaimtemplates

Conversation

@jensens

@jensens jensens commented Oct 25, 2026

Copy link
Copy Markdown
Member

Closes #46. Part of the 1.0 API hardening (#106 (comment)).

Problem

A StatefulSet's volumeClaimTemplates are immutable. An edit on a live VinylCache passed admission. Every following reconcile then failed on the StatefulSet update, and the cache stayed in an error loop until the edit was reverted.

Change

  • ValidateUpdate passes the old object to the new ValidateVinylCacheUpdate. That function runs the existing common checks and rejects any change to spec.volumeClaimTemplates.
  • The comparison uses equality.Semantic.DeepEqual, so 1Gi against 1024Mi, or nil against [], is not a change.
  • A CEL transition rule was the alternative. I did not use it, because it compares quantities as strings and would reject a mere change of notation.

The error message differs from the one proposed in the issue. The issue suggested "delete and recreate the VinylCache (PVCs are preserved)". But the operator sets no persistentVolumeClaimRetentionPolicy, so the default Retain applies, and a recreated cache binds the old PVCs again at their old size. The message and the SSD how-to therefore say what actually works:

  • resize the PVCs directly, if the StorageClass allows expansion,
  • or delete the VinylCache and its PVCs and create it again.

Verification

  • Unit table:
    • Admitted: unchanged, same size in another notation, none before and after.
    • Rejected: size changed, template added, template removed, template renamed.
    • The common checks still run on update.
  • envtest against a real API server: an update that leaves the templates alone is admitted; a size change is rejected by the webhook. With the old wiring (ValidateVinylCache(newObj)) this spec fails, which shows it really exercises the old object.
  • make lint, make test, make test-int are green.

Assisted-by: Claude Opus 5.5

@jensens jensens added this to the 1.0 milestone Oct 25, 2026
A StatefulSet's volumeClaimTemplates are immutable. An edit on a live
VinylCache passed admission, and every later reconcile then failed on
the StatefulSet update, leaving the cache in a permanent error loop
until the edit was reverted (#46).

ValidateUpdate now passes the old object to ValidateVinylCacheUpdate,
which runs the common checks and rejects any change to the templates.
It compares with semantic equality, so 1Gi against 1024Mi, or nil
against an empty list, is not a change.

The error and the SSD how-to explain the way out. The PVCs outlive the
VinylCache and are bound again by a recreated one, so recreating alone
does not resize them: resize the PVCs, or delete them too.

Closes #46

Assisted-by: Claude Opus 5.5
@jensens
jensens force-pushed the fix/immutable-volumeclaimtemplates branch from eb18aa0 to 9f1fd07 Compare October 27, 2026 14:32
@jensens
jensens merged commit eb2511f into main Oct 27, 2026
8 checks passed
@jensens
jensens deleted the fix/immutable-volumeclaimtemplates branch October 27, 2026 22:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Webhook: reject edits to spec.volumeClaimTemplates on existing VinylCaches

1 participant