Repository navigation
perf(operator): stop caching the content of every Secret in the cluster - #327
Conversation
![ferrfleet-interne[bot]](https://avatars.githubusercontent.com/in/5311663?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks correct. Both Secret map funcs (secretsReferencingTokenSecret and the inline one in the connection controller) only use GetName/GetNamespace, so OnlyMetadata is safe there. All typed Secret reads (TokenBroker.loadFromSecret, targetExists, targetContentHash, ensureTargetSecret) go straight to the API server because of DisableFor. Owned-Secret updates still fire, since resourceVersion is part of the metadata.
Nit: the package doc in internal/controller/token_broker.go:6-8 still says the tokenSecretRef path relies on "what the client cache already does on the Secret". That stops being true with this change: every reconcile now does a live GET. Worth rewording so nobody puts a cache back in to "restore" that behaviour.
There was a problem hiding this comment.
f33a4ef fixes the import grouping nit in cmd/main_test.go. Nothing else changed, still good.
## [6.1.1] - 2026-10-25 ### Bug Fixes - perf(operator): stop caching the content of every Secret in the cluster (#327)
Secret watches (Owns and Watches in both controllers) are now metadata-only, and Secret reads go straight to the API server instead of the cache. The operator no longer holds the data of every Secret in the cluster in memory.
The label-filtered cache from the issue is not used: target Secrets can pre-exist without the label, so a filtered cache would make create-or-update fail with AlreadyExists. Cost is one API read per Secret per reconcile.
Closes #314