Skip to content

fix: scope SpinAppExecutor finalizer check to executor's namespace #491

Merged
vdice merged 2 commits into
spinframework:mainfrom
vdice:fix/executor-finalizer-cross-namespace
Apr 14, 2026
Merged

fix: scope SpinAppExecutor finalizer check to executor's namespace #491
vdice merged 2 commits into
spinframework:mainfrom
vdice:fix/executor-finalizer-cross-namespace

Conversation

@vdice
Copy link
Copy Markdown
Contributor

@vdice vdice commented Apr 14, 2026

Supersedes #481 to close #480. Just rebased and applied a minor item of feedback from 481.

@vdice
Copy link
Copy Markdown
Contributor Author

vdice commented Apr 14, 2026

melderan and others added 2 commits April 14, 2026 13:17
The handleDeletion() method lists dependent SpinApps by executor name
across all namespaces. This causes a SpinApp in namespace B to block
deletion of an unrelated SpinAppExecutor with the same name in
namespace A — even though there are zero SpinApps in namespace A.

This is particularly impactful because the common pattern (and the Helm
chart bootstrap hook) uses the same executor name "containerd-shim-spin"
in every namespace. All executors with that name become cross-coupled.

The fix adds client.InNamespace(executor.Namespace) to scope the
dependent SpinApp lookup to the executor's own namespace.

Includes a regression test that creates same-named executors in two
namespaces with a SpinApp only in one, then verifies deleting the
executor in the other namespace succeeds.

Fixes spinframework#480

Signed-off-by: John Moore <melderan@gmail.com>
…ically

Signed-off-by: Vaughn Dice <vdice@akamai.com>
@vdice vdice force-pushed the fix/executor-finalizer-cross-namespace branch from 88c1626 to 761767e Compare April 14, 2026 19:17
Copy link
Copy Markdown
Contributor

@kate-goldenring kate-goldenring left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks @vdice. It may be worth doing a look over (with copilot) of other places we may be missing namespace scoping.

@vdice vdice mentioned this pull request Apr 14, 2026
@vdice vdice merged commit 943f5b1 into spinframework:main Apr 14, 2026
18 checks passed
@vdice vdice deleted the fix/executor-finalizer-cross-namespace branch April 14, 2026 22:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SpinAppExecutor finalizer checks for dependent SpinApps across all namespaces instead of its own

3 participants