Addressing coderabbit PR comments

Author: bentito

pkg/router/controller/route_secret_manager.go

@@ -329,12 +329,12 @@ func (p *RouteSecretManager) generateSecretHandler(namespace, routeName string)
 			if !ok {
 				tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
 				if !ok {
-					log.Error(nil, "Couldn't get object from tombstone", "obj", obj)
+					log.Error(nil, "Couldn't get object from tombstone", "type", fmt.Sprintf("%T", obj))
 					return
 				}
 				secret, ok = tombstone.Obj.(*kapi.Secret)
 				if !ok {
-					log.Error(nil, "Tombstone contained object that is not a secret", "obj", tombstone.Obj)
+					log.Error(nil, "Tombstone contained object that is not a secret", "type", fmt.Sprintf("%T", tombstone.Obj))
 					return
 				}
 			}
@@ -386,8 +386,8 @@ func (p *RouteSecretManager) validate(route *routev1.Route) error {
 // Note: This function performs an in-place update of the route. The caller should be aware that the route's TLS configuration will be modified directly.
 func (p *RouteSecretManager) populateRouteTLSFromSecret(route *routev1.Route) error {
 	// read referenced secret from the informer cache.
-	// RegisterRoute blocks until cache sync completes, so the secret should be
-	// available immediately after registration.
+	// GetSecret attempts to read from the cache and falls back to a direct API
+	// call if the cache is not synced or the secret is not found.
 	secret, err := p.secretManager.GetSecret(context.TODO(), route.Namespace, route.Name)
 	if err != nil {
 		log.Error(err, "failed to get referenced secret")

pkg/router/controller/shared_secret_manager.go

@@ -129,7 +129,7 @@ func (m *SharedSecretManager) RegisterRoute(ctx context.Context, namespace strin
 			cache.Indexers{},
 		)
 
-		inf.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		if _, err := inf.AddEventHandler(cache.ResourceEventHandlerFuncs{
 			AddFunc: func(obj interface{}) {
 				m.notify(namespace, obj, "Add", nil)
 			},
@@ -139,7 +139,11 @@ func (m *SharedSecretManager) RegisterRoute(ctx context.Context, namespace strin
 			DeleteFunc: func(obj interface{}) {
 				m.notify(namespace, obj, "Delete", nil)
 			},
-		})
+		}); err != nil {
+			delete(m.registeredRoutes, key)
+			m.lock.Unlock()
+			return fmt.Errorf("failed to add secret informer handler for key %s: %w", infKey, err)
+		}
 
 		ctx, cancel := context.WithCancel(context.Background())
 		infState = &informerState{
@@ -246,6 +250,11 @@ func (m *SharedSecretManager) UnregisterRoute(namespace string, routeName string
 	return nil
 }
 
+// GetSecret returns the secret from the informer cache or falls back to an API call.
+// WARNING: To maintain high throughput and reduce GC pressure during route syncs,
+// the returned Secret is a direct pointer to the shared informer cache object.
+// Callers MUST NOT mutate the returned Secret. If mutation is required, the caller
+// must explicitly call secret.DeepCopy() first.
 func (m *SharedSecretManager) GetSecret(ctx context.Context, namespace string, routeName string) (*corev1.Secret, error) {
 	m.lock.RLock()
 	key := namespace + "/" + routeName