Skip to content

Conversation

@crenshaw-dev
Copy link
Contributor

@crenshaw-dev crenshaw-dev commented Oct 22, 2025

I encountered a problem where the kubeconfig field hadn't been set, but the failure was too quiet for me to understand what went wrong.

I think error level makes sense, because if I've labeled the Secret to be used but haven't finished setting it up, I've done something wrong.

Since it's a user error instead of controller error, maybe it should be warn instead? But I didn't see a warn level.

Here's what the logs look like:

  2025-10-23T09:25:33-04:00     ERROR   kubeconfig-provider     Secret does not contain kubeconfig data, skipping       {"cluster": "invalid-secret", "secret": "testing/invalid-secret", "key": "config"}
  sigs.k8s.io/multicluster-runtime/providers/kubeconfig.(*Provider).Reconcile
        /Users/mcrenshaw/src/multicluster-runtime/providers/kubeconfig/provider.go:204
  sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile
        /Users/mcrenshaw/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:216
  sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler
        /Users/mcrenshaw/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:461
  sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
        /Users/mcrenshaw/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:421
  sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1
        /Users/mcrenshaw/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:296

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 22, 2025
@k8s-ci-robot
Copy link
Contributor

Welcome @crenshaw-dev!

It looks like this is your first PR to kubernetes-sigs/multicluster-runtime 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/multicluster-runtime has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Oct 22, 2025
kubeconfigData, ok := secret.Data[p.opts.KubeconfigSecretKey]
if !ok || len(kubeconfigData) == 0 {
log.Info("Secret does not contain kubeconfig data, skipping", "key", p.opts.KubeconfigSecretKey)
log.Error(errors.New("secret does not contain kubeconfig data, skipping"), "key", p.opts.KubeconfigSecretKey)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense, just one nit, our log lines usually start with uppercase, e.g.:

Suggested change
log.Error(errors.New("secret does not contain kubeconfig data, skipping"), "key", p.opts.KubeconfigSecretKey)
log.Error(errors.New("Secret does not contain kubeconfig data, skipping"), "key", p.opts.KubeconfigSecretKey)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or wait, now that I think about it, how does this log line look exactly? I guess log.Error might be wrapping it differently?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. Looking closer, I think the correct way to do this is to provide the capitalized message in as the second arg and leave the first arg nil. I've added to the description what the log line now looks like.

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: crenshaw-dev
Once this PR has been reviewed and has the lgtm label, please ask for approval from embik. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 23, 2025
Expect(err).NotTo(HaveOccurred())

// Verify the cluster count hasn't changed (secret was skipped)
Eventually(provider.ListClusters, "2s").Should(HaveLen(2))
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not happy with doing Eventually then Consistently, but I found that provider.ListClusters was coming up empty and failing Consistently if I didn't add the Eventually first.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It kind of makes sense since you might be checking the list before clusters have been processed and added. But I don't think we need the Consistently once Eventually has passed.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added Consistently to cover this case:

  1. Before the test starts, the provider processed the existing two secrets, so provider.ListClusters is sitting at length 2
  2. We add the bad secret
  3. Before the provider has a chance to pick up the bad secret, we assert that Eventually we have length 2
  4. The Eventually passes, and the test succeeds
  5. After the test passes, a bug in the provider allows the bad secret to be treated as a cluster, and provider.ListClusters goes to length 3

@crenshaw-dev
Copy link
Contributor Author

@embik I improved the log line and also added tests. Happy to drop the tests if review/iteration costs more time than its worth. :-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants