Skip to content

hub: keep previous state when reload fails#635

Merged
tamalsaha merged 1 commit into
masterfrom
fix/loader-reload-no-panic
May 19, 2026
Merged

hub: keep previous state when reload fails#635
tamalsaha merged 1 commit into
masterfrom
fix/loader-reload-no-panic

Conversation

@tamalsaha
Copy link
Copy Markdown
Contributor

Summary

  • All eight hub YAML loaders (hub/resourcedescriptors/lib.go, resourceeditors/, resourcedashboards/, resourceoutlines/, resourcetabledefinitions/, resourceblockdefinitions/, menuoutlines/, clusterprofiles/) wiped the package-global map at the start of every reload and paniced on any walk/unmarshal error.
  • ReloadIfTriggered is invoked from init() (panic OK — embedded data is part of the build) and from every public lookup. The hot-reload mechanism documented in hub/README.mdkubectl cp a YAML into the pod's /tmp/hub/<kind>/, write to the trigger file — would therefore kill the running api-server from the first caller after a bad YAML was dropped.
  • Build into a temporary map per loader. Swap into the package globals only when the walk succeeds. On reload failure, klog.ErrorS and keep the previous map. The first-load case (package globals still nil) still panics so init() crashes loud if embedded data is malformed.

Test plan

  • make unit-tests
  • Drop a syntactically broken YAML into /tmp/hub/resourcedescriptors/, touch the trigger file, and confirm the api-server logs an error and keeps serving the previous descriptors instead of crashing.
  • Confirm init() still panics when an embedded YAML is intentionally corrupted (use go build -tags fault style if needed).

🤖 Generated with Claude Code

All eight YAML loaders (resourcedescriptors, resourceeditors,
resourcedashboards, resourceoutlines, resourcetabledefinitions,
resourceblockdefinitions, menuoutlines, clusterprofiles) wiped the
package-global map at the start of every reload and panicked on any
walk error.

ReloadIfTriggered is invoked from init() (where panic is acceptable —
embedded data must be valid) AND from every public lookup, so a
hot-reloaded bad YAML dropped into /tmp/hub/<kind>/ — exactly the
workflow documented in hub/README.md for live api-servers — would
kill the running process from the next caller.

Build into a temporary map per loader and swap atomically only when
the walk succeeds. On reload failure, klog and keep the previous map.
The first-load case (package globals still nil) still panics so init
crashes loud if embedded data is bad.

Signed-off-by: Tamal Saha <tamal@appscode.com>
@tamalsaha tamalsaha merged commit 9969ccb into master May 19, 2026
3 of 7 checks passed
@tamalsaha tamalsaha deleted the fix/loader-reload-no-panic branch May 19, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant