Fix RouteSecretManager panic and update library-go dependency

bentito · bentito · commit 4e1eae423379 · 2026-03-23T09:50:06.000-04:00
- Handle DeletedFinalStateUnknown tombstones in secret manager to prevent panics during namespace deletion
- Update library-go dependency to include async secret registration fix (library-go PR #2132)
- Use /tmp for fake haproxy unix sockets to avoid macOS path length limits in tests
diff --git a/go.mod b/go.mod
@@ -117,3 +117,5 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
+
+replace github.com/openshift/library-go => github.com/bentito/library-go v0.0.0-20260316154701-200e1ee46963
diff --git a/go.sum b/go.sum
@@ -13,6 +13,8 @@ github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/bcicen/go-haproxy v0.0.0-20180203142132-ff5824fe38be h1:7b8/p7wJ3N/OjXbZmwJdyR9eOoCla5SbUIe18WHio5s=
 github.com/bcicen/go-haproxy v0.0.0-20180203142132-ff5824fe38be/go.mod h1:MxVpaKTkNjZu5awzzr6mk6CIKaZYUFGxbmNwMvyVfeM=
+github.com/bentito/library-go v0.0.0-20260316154701-200e1ee46963 h1:jhARqaZphAvzRd1htPKPSLHAMEg01p9/CgmrNvqLLxM=
+github.com/bentito/library-go v0.0.0-20260316154701-200e1ee46963/go.mod h1:K3FoNLgNBFYbFuG+Kr8usAnQxj1w84XogyUp2M8rK8k=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -184,8 +186,6 @@ github.com/openshift/api v0.0.0-20260212193555-c06ab675261f h1:l1IgsK48Ym/nED30y
 github.com/openshift/api v0.0.0-20260212193555-c06ab675261f/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
 github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13 h1:6rd4zSo2UaWQcAPZfHK9yzKVqH0BnMv1hqMzqXZyTds=
 github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13/go.mod h1:YvOmPmV7wcJxpfhTDuFqqs2Xpb3M3ovsM6Qs/i2ptq4=
-github.com/openshift/library-go v0.0.0-20260223145824-7b234b47a906 h1:PkG3CmlU8+HtlW1rspnhwhbKki8rrwYN+L26aH11t2E=
-github.com/openshift/library-go v0.0.0-20260223145824-7b234b47a906/go.mod h1:K3FoNLgNBFYbFuG+Kr8usAnQxj1w84XogyUp2M8rK8k=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
 github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
diff --git a/pkg/router/controller/route_secret_manager.go b/pkg/router/controller/route_secret_manager.go
@@ -330,7 +330,19 @@ func (p *RouteSecretManager) generateSecretHandler(namespace, routeName string)
 		},
 
 		DeleteFunc: func(obj interface{}) {
-			secret := obj.(*kapi.Secret)
+			secret, ok := obj.(*kapi.Secret)
+			if !ok {
+				tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+				if !ok {
+					log.Error(nil, "Couldn't get object from tombstone", "obj", obj)
+					return
+				}
+				secret, ok = tombstone.Obj.(*kapi.Secret)
+				if !ok {
+					log.Error(nil, "Tombstone contained object that is not a secret", "obj", tombstone.Obj)
+					return
+				}
+			}
 			key := generateKey(namespace, routeName)
 			msg := fmt.Sprintf("secret %q deleted for route %q", secret.Name, key)
 			log.V(4).Info(msg)
diff --git a/pkg/router/template/configmanager/haproxy/testing/haproxy.go b/pkg/router/template/configmanager/haproxy/testing/haproxy.go
@@ -46,7 +46,7 @@ type fakeHAProxy struct {
 }
 
 func startFakeHAProxyServer(prefix string) (*fakeHAProxy, error) {
-	f, err := os.CreateTemp(os.TempDir(), prefix)
+	f, err := os.CreateTemp("/tmp", prefix)
 	if err != nil {
 		return nil, err
 	}
@@ -107,10 +107,10 @@ func (p *fakeHAProxy) Commands() []string {
 
 func (p *fakeHAProxy) Start() {
 	started := make(chan bool)
-	go func() error {
+	go func() {
 		listener, err := net.Listen("unix", p.socketFile)
 		if err != nil {
-			return err
+			panic(fmt.Sprintf("fakeHAProxy Start failed to listen on %s: %v", p.socketFile, err))
 		}
 
 		started <- true
@@ -119,11 +119,11 @@ func (p *fakeHAProxy) Start() {
 			shutdown := p.shutdown
 			p.lock.Unlock()
 			if shutdown {
-				return nil
+				return
 			}
 			conn, err := listener.Accept()
 			if err != nil {
-				return err
+				return
 			}
 			go p.process(conn)
 		}
diff --git a/vendor/github.com/openshift/library-go/pkg/route/secretmanager/manager.go b/vendor/github.com/openshift/library-go/pkg/route/secretmanager/manager.go
diff --git a/vendor/github.com/openshift/library-go/pkg/secret/secret_monitor.go b/vendor/github.com/openshift/library-go/pkg/secret/secret_monitor.go
diff --git a/vendor/modules.txt b/vendor/modules.txt
@@ -221,7 +221,7 @@ github.com/openshift/client-go/route/clientset/versioned/scheme
 github.com/openshift/client-go/route/clientset/versioned/typed/route/v1
 github.com/openshift/client-go/route/clientset/versioned/typed/route/v1/fake
 github.com/openshift/client-go/route/listers/route/v1
-# github.com/openshift/library-go v0.0.0-20260223145824-7b234b47a906
+# github.com/openshift/library-go v0.0.0-20260223145824-7b234b47a906 => github.com/bentito/library-go v0.0.0-20260316154701-200e1ee46963
 ## explicit; go 1.24.0
 github.com/openshift/library-go/pkg/crypto
 github.com/openshift/library-go/pkg/proc
@@ -1324,3 +1324,4 @@ sigs.k8s.io/structured-merge-diff/v6/value
 # sigs.k8s.io/yaml v1.6.0
 ## explicit; go 1.22
 sigs.k8s.io/yaml
+# github.com/openshift/library-go => github.com/bentito/library-go v0.0.0-20260316154701-200e1ee46963

Original file line number	Diff line number	Diff line change
`@@ -117,3 +117,5 @@ require (`
`117`	`117`	`sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect`
`118`	`118`	`sigs.k8s.io/yaml v1.6.0 // indirect`
`119`	`119`	`)`
	`120`	`+`
	`121`	`+replace github.com/openshift/library-go => github.com/bentito/library-go v0.0.0-20260316154701-200e1ee46963`
Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@ type fakeHAProxy struct {`
`46`	`46`	`}`
`47`	`47`
`48`	`48`	`func startFakeHAProxyServer(prefix string) (*fakeHAProxy, error) {`
`49`		`- f, err := os.CreateTemp(os.TempDir(), prefix)`
	`49`	`+ f, err := os.CreateTemp("/tmp", prefix)`
`50`	`50`	`if err != nil {`
`51`	`51`	`return nil, err`
`52`	`52`	`}`
`@@ -107,10 +107,10 @@ func (p *fakeHAProxy) Commands() []string {`
`107`	`107`
`108`	`108`	`func (p *fakeHAProxy) Start() {`
`109`	`109`	`started := make(chan bool)`
`110`		`- go func() error {`
	`110`	`+ go func() {`
`111`	`111`	`listener, err := net.Listen("unix", p.socketFile)`
`112`	`112`	`if err != nil {`
`113`		`- return err`
	`113`	`+ panic(fmt.Sprintf("fakeHAProxy Start failed to listen on %s: %v", p.socketFile, err))`
`114`	`114`	`}`
`115`	`115`
`116`	`116`	`started <- true`
`@@ -119,11 +119,11 @@ func (p *fakeHAProxy) Start() {`
`119`	`119`	`shutdown := p.shutdown`
`120`	`120`	`p.lock.Unlock()`
`121`	`121`	`if shutdown {`
`122`		`- return nil`
	`122`	`+ return`
`123`	`123`	`}`
`124`	`124`	`conn, err := listener.Accept()`
`125`	`125`	`if err != nil {`
`126`		`- return err`
	`126`	`+ return`
`127`	`127`	`}`
`128`	`128`	`go p.process(conn)`
`129`	`129`	`}`