Follow-up from PR #94 review (finding #6).
Problem
mergeStringSet / mergePullSecretDelivery (aif-operator/internal/controller/aiworkload/pullsecrets.go) only ever union new entries into AIWorkload.Status.PullSecretDeliveries. The list is never recomputed during normal reconciliation — it only fully resets on finalize/delete.
Consequence
If a workload's desired set of (namespace, secret names) shrinks at runtime — e.g. a Blueprint is edited to drop a component or move it to a different namespace, or a vendor changes — the stale buckets persist:
reconcilePullSecrets keeps merging stale secret names into local ServiceAccounts.deliverPullSecrets keeps shipping Fleet bundles to namespaces the workload no longer uses.kubectl get aiworkload shows stale entries.
It is not a corruption bug (downstream factory has no case for unknown names, so no bundle content is produced for truly-removed secrets), but it is incorrect drift that lingers until the workload is deleted.
Proposed fix
Rebuild Status.PullSecretDeliveries from the current desired state each reconcile instead of union-accumulating. This requires every component/injector path to (re)report its deliveries each pass so the controller can replace rather than merge. Needs care to avoid transiently dropping entries mid-reconcile (e.g. compute the full desired set, then diff/replace once).
Disposition
Deferred from PR #94 to keep that PR's scope contained. The union-only behavior is documented in the code and PR description.
Follow-up from PR #94 review (finding #6).
Problem
mergeStringSet/mergePullSecretDelivery(aif-operator/internal/controller/aiworkload/pullsecrets.go) only ever union new entries intoAIWorkload.Status.PullSecretDeliveries. The list is never recomputed during normal reconciliation — it only fully resets on finalize/delete.Consequence
If a workload's desired set of (namespace, secret names) shrinks at runtime — e.g. a Blueprint is edited to drop a component or move it to a different namespace, or a vendor changes — the stale buckets persist:
reconcilePullSecretskeeps merging stale secret names into local ServiceAccounts.deliverPullSecretskeeps shipping Fleet bundles to namespaces the workload no longer uses.kubectl get aiworkloadshows stale entries.It is not a corruption bug (downstream factory has no case for unknown names, so no bundle content is produced for truly-removed secrets), but it is incorrect drift that lingers until the workload is deleted.
Proposed fix
Rebuild
Status.PullSecretDeliveriesfrom the current desired state each reconcile instead of union-accumulating. This requires every component/injector path to (re)report its deliveries each pass so the controller can replace rather than merge. Needs care to avoid transiently dropping entries mid-reconcile (e.g. compute the full desired set, then diff/replace once).Disposition
Deferred from PR #94 to keep that PR's scope contained. The union-only behavior is documented in the code and PR description.