Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Namespace deletion leaves AI Gateway keys and AI providers in Coder

Ouverte
  • Quelque chose ne va pas ?
#353 4 commentaires 0 réactions 1 personne assignée Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@ThomasK33 y travaille déjà.

Depuis le 14/10/2026.

Évaluation

Cette issue n'a pas encore été évaluée.

Description

Problem

When a namespace is deleted, Kubernetes deletes the CoderControlPlane and its CoderAIGatewayKey objects at the same time. The operator then cannot reach Coder: the control plane is gone, or its Coder pod is already down when the bounded pass runs. So it releases the finalizers without deleting the keys, and full-trust gateway keys stay valid in Coder. CoderAIProvider has the same gap for providers.

Seen in the dogfood run of #346 (see the G3 evidence comment, step 13):

  • The namespace was gone after 11 s.
  • The key row stayed in Coder's ai_gateway_keys table.
  • The operator logged Releasing the finalizer without deleting the keys in Coder with reason ControlPlaneGone and the key ID.

Today the how-to (docs/how-to/manage-ai-gateway-keys.md) warns about this and gives the cleanup: delete the key objects before the namespace, or delete the logged keys with coder ai-gateway keys delete.

Options

  1. A cluster-wide sweeper (plan risk RK7) that deletes ck8s-<uid>- keys whose UID no CoderAIGatewayKey has, after the settle window. The same idea works for providers.
  2. Hold the control plane's deletion (a finalizer or a deletion check) while dependent CoderAIGatewayKey and CoderAIProvider objects exist, so they are cleaned up first.

Related items to decide together

  • While the control plane is being deleted, a failed operator-access read releases at once without a retry (#156 plan, K9 notes item q). This is a second path that leaves keys.
  • The CoderAnswerMismatch gate is lost when the status write right after the mismatch fails (K9 notes item u). The settle window bounds this to one extra create, whose key the sweep deletes.
  • A metric or a Kubernetes Event for ControlPlaneGone releases. Today the log line is the only signal.

Refs #156

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Langage dominant
Go
Étoiles
5
Forks
3
Merge moyen
3 h
PR mergées (30 j)
192

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de coder/coder-k8s

Toutes les issues de coder/coder-k8s

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.