fix: delete resources the provider cannot read back; keep secret inputs out of read/delete - #11
Merged
Merged
Conversation
Since pulumi 3.252 the stateless `pulumi do delete` reads the resource (an import by id) before calling the provider's Delete and aborts when that read fails. Providers without read for a type (random pets) or whose importer rejects the stored id (random integers) could therefore never be deleted: the finalizer retried DeleteFailed forever and dependents wedged behind it in BlockedByDependents. The cluster already holds the state the provider needs. The controller now hands the runner the recorded status.outputs (valuesFrom paths stripped, so no secret enters a Job spec; oversized states are dropped). When the stateless delete dies in its read phase, the runner imports a synthesized one-resource checkpoint into a throwaway stack on the pod's file backend and runs `pulumi destroy`, which passes the provider exactly the state a successful read would have. Delete-phase failures are not retried this way; git and registry packages have no fallback. Verified on kind with pulumi 3.262.0: thirteen previously stuck random resources (pets, strings, a shuffle) deleted within twenty seconds of the fixed manager starting, and the credential-free examples now create and tear down cleanly. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The reconcile ctx carries the valuesFrom plan for the whole pass, and
every runner op consumed it. A read or delete has no properties, so the
substitution conjured an input file that `pulumi do read` rejects
("unknown flag: --input-file"): every drift read of a resource with
valuesFrom flipped Synced to OperationFailed, and a Secret missing at
teardown time could block a delete for no reason. Read and delete Jobs
also carried the secretKeyRef env and the rotation salt in their names.
Only verbs whose properties can carry secret inputs (create, patch and
the engine verbs, which the runner refuses explicitly) consume the plan
now, at both layers: the runner drops it for read and delete, and the
Job and exec runners attach neither env nor salt to those ops.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…obs run Example 11 shipped its input Secret next to the DoResource, but with the default runner.namespaceMode=operator the runner Job runs in the operator namespace and the pet failed with SecretInputMissing as written. The Secret now targets doplane-system, with the resource-mode alternative documented in the header. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-opened against main: #10 was merged into the CLI-bump branch because retargeting it failed on a GitHub API error. Same three commits, already reviewed in #10 (#10), which holds the full description and verification evidence.
🤖 Generated with Claude Code