[lfrancke]

Description

Found this while investigating something entirely different.

Basically: secret-operator currently creates a new mount everytime NodePublishVolume is called. They stack on top of each other (I had 21 here locally for one of my test clusters :) ) and only a single one is unmounted per retry and then we need to wait for a timeout so it took minutes deleting that.

And then Claude found another issue that was uncovered after fixing the first: Because so far we'd get a new mount every time it wasn't a problem but now we write the cert to a file which might already exist but we don't truncate it so it could still contain old trailing bytes. That was an easy fix.

The CSI spec requires NodePublishVolume to be idempotent and this hould help wtih that.

Author

• Integration tests passed (for non trivial changes)
• Release note snippet added

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker

[lfrancke]

I ran all kuttl tests and they pass:

Test	Result	Duration
kerberos (krb5 1.21.1)	✅	90.4 s
tls, 2048 bit, default secret names	✅	86.6 s
cert-manager-tls	✅	59.4 s
non-sensitive-data	✅	43.7 s
listener	✅	29.6 s
tls, 3072 bit, custom secret names	✅	19.1 s
tls, 3072 bit, default secret names	✅	17.0 s
tls, 2048 bit, custom secret names	✅	13.6 s
tls-truststore, Secret	✅	8.4 s
tls-truststore, ConfigMap	✅	8.1 s

[lfrancke]

I also added a test (using jig) for the new behavior here and I could backport it to kuttl but for that to work I'd need to make other changes to the operator so I decided against it.

11/11 passed in 184.8 s.

Test	Result	Duration
cert-manager-tls	✅ passed	10.4 s
kerberos	✅ passed	15.1 s
listener	✅ passed	10.4 s
non-sensitive-data	✅ passed	5.3 s
republish	✅ passed	21.2 s
tls (custom_secret_names=true, rsa_key_length=2048)	✅ passed	5.4 s
tls (custom_secret_names=false, rsa_key_length=2048)	✅ passed	5.5 s
tls (custom_secret_names=true, rsa_key_length=3072)	✅ passed	10.4 s
tls (custom_secret_names=false, rsa_key_length=3072)	✅ passed	15.4 s
tls-truststore (truststore_target_kind=ConfigMap)	✅ passed	10.4 s
tls-truststore (truststore_target_kind=Secret)	✅ passed	10.4 s

[Techassi]

Only a single small suggestion, otherwise looking good.

[lfrancke]

Release note

Previously, when a secret volume was published again, for example after a kubelet restart, the secret-operator mounted a new tmpfs on top of the existing one each time, which kept Pods in Terminating for minutes. With this release, the existing mount is reused.