CoderMCPServer delete and RBAC test follow-ups
维护者通常 1 天内回复
@ThomasK33 已经在做这个了。
开始于 2026年10月14日。
评估
这个 Issue 还没有评估数据。
描述
Follow-ups from the final assessments of #368 (CoderMCPServer delete path), #376 (test S9) and #377 (test S11). None blocks the activation. Line numbers refer to main after #368.
Delete path
- A marker-only object waits forever when its pinned Coder organization is deleted while the control plane lives. With only a create marker (no
status.configID), the delete reads the organization's MCP server configs (findMCPServerSlug,internal/controller/codermcpserver_controller.go:492). Any list error, including Coder's own 404 for the deleted organization, givesCoderUnavailable, so the finalizer stays. Fix: treat Coder's own 404 on that list (isCoderResourceNotFound) as absence. A proxy 404 must still wait. - Missing tests:
- No operator access on delete: the wait branch at
internal/controller/codermcpserver_delete.go:61. - A marker-only delete when the operator is not a site owner:
internal/controller/codermcpserver_delete.go:107. - A marker-only delete when the config list fails.
- No operator access on delete: the wait branch at
- A manual finalizer removal leaves the object's
sentCredentialsentry in memory until the operator restarts. The entry holds only hashes, not values. The release path removes it, but a hand-removed finalizer skips that path.
RBAC test S9 (#376)
- S9 reads only
config/rbac/role.yaml. It must scan everyconfig/rbac/*.yamlfor rules that reach core Secrets, and also pinconfig/rbac/clusterrolebinding.yaml, so a new Role or binding cannot widen Secret access without a golden-copy change.
Admission test S11 (#377)
- The comment of
TestCoderMCPServerStatusPolicysays the policy "denies the status writes of every other test". It denies only status writes ofCoderMCPServerobjects. Correct the comment.
Refs #155
Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $220.71
- 主要语言
- Go
- 星标
- 5
- 派生
- 3
- 平均合并
- 3 小时
- 30 天内合并 PR
- 192
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
coder/coder-k8s 的其他 Issue
-
CoderWorkspacePoolMember checkCreate: trust only Coder's own 404 on the name lookup (before PR 12)未关闭
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
TestReconcile_LicenseRotationUploadsNewSecretValue fails at -count=3 (reuses a control plane name)未关闭
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 1 天内回复
-
CoderMCPServer Kind E2E follow-ups可能已有人在做 @ThomasK33 于 6 天前认领。 未关闭
coder/coder-k8s#390 · 已指派 1 人 ·
维护者通常 1 天内回复
-
Ownership proof for Coder IDs recorded in controller status (D11 B)可能已有人在做 @ThomasK33 于 6 天前认领。 未关闭
coder/coder-k8s#372 · 已指派 1 人 ·
维护者通常 1 天内回复
-
Namespace deletion leaves AI Gateway keys and AI providers in Coder可能已有人在做 @ThomasK33 于 6 天前认领。 未关闭
coder/coder-k8s#353 · 4 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 69/100
aws/amazon-ecs-agent#5177 ·
维护者通常 2 天内回复
-
release-followup
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
kind/bug
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
apache/rocketmq-dashboard#7292 ·
维护者通常 3 天内回复
-
[Bug]: Deleting an MCP proxy leaves its API keys in the gateway's memory and in the policy engine未关闭Aspect/API Aspect/Other Severity/Minor Type/Bug
难度 2/5 1-3 小时 新手友好度 83/100
wso2/api-platform#3852 ·
维护者通常 1 天内回复