fix(operator): detect vMCP volume drift - #6299
Open
jstar0 wants to merge 1 commit into
Open
Conversation
Hash the complete generated volume and volume-mount state so changes to referenced Secrets, ConfigMaps, and CA bundles roll the Deployment. Signed-off-by: King Star <mcxin.y@gmail.com>
jstar0
requested review from
ChrisJBurns,
JAORMX,
blkt,
jerm-dro,
jhrozek,
rdimitrov,
reyortiz3 and
tgrunnagle
as code owners
August 13, 2026 08:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes to Secrets, ConfigMaps, and CA bundles referenced by a vMCP deployment can change the generated pod volumes without changing the existing pod-template hash. The operator therefore leaves a stale deployment running.
This change hashes the complete generated volume and volume-mount state used by the pod template and compares that hash during reconciliation. It also removes the annotation when the desired state no longer contains a volume hash.
Fixes #5619
Type of change
Test plan
go test ./cmd/thv-operator/controllers -count=1)task test-e2e)task lint-fix)API Compatibility
v1beta1API.Changes
virtualmcpserver_controller.govirtualmcpserver_deployment.goDoes this introduce a user-facing change?
No. The operator now rolls deployments when referenced volume inputs change.
Special notes for reviewers
The focused controller package tests pass on the rebased branch.