Service-catalog: Updating a Service Instance referenced Secret doesn't trigger instance update

Created on 28 Aug 2018 · 3Comments · Source: kubernetes-sigs/service-catalog

Updating a Service Instance referenced Secret doesn't trigger instance update

What happened:
I created an instance which as it's parameters referenced a secret containing a single key with a JSON value.

This is the instance.yml:

apiVersion: servicecatalog.k8s.io/v1beta1
kind: ServiceInstance
metadata:
  name: my-instance
spec:
  clusterServiceClassExternalName: my-service-class
  clusterServicePlanExternalName: my-plan
  parametersFrom:
    - secretKeyRef:
        name: status-secret
        key: statusKey

This is the status-secret.yml:

apiVersion: v1
kind: Secret
metadata:
  name: status-secret
type: Opaque
stringData:
  statusKey: '{"status": true}'

And so my first commands where:

kubectl create -f status-secret.yml
kubectl create -f instance.yml

Afterwards I wanted to change the JSON status value to be false and so I updated the status-secret.yml file like so:

apiVersion: v1
kind: Secret
metadata:
  name: status-secret
type: Opaque
stringData:
  statusKey: '{"status": false}'

I then ran kubectl apply -f status-secret.yml to update the resource in the cluster.

The secret was successfully updated, but the Service Catalog did not catch the change and therefore didn't make a _Update Service Instance request_ with the new parameters to the corresponding _Service Broker_.

What you expected to happen:
My expectations were that there would be listeners for any changes to referenced resources by a service instance (listening for changes in secrets' key values, like in this example).

How to reproduce it (as minimally and precisely as possible):
I basically laid it out there in the first point.

Environment:

Kubernetes version (use kubectl version): 1.10 (tried with 1.9 as well)
service-catalog version: 0.1.26
Cloud provider or hardware configuration: Local MacBook Pro

Source

NickyMateev

Most helpful comment

The Service Catalog controller doesn't watch the referenced secrets. You need to touch the ServiceInstance to trigger an update. That's also how core Kubernetes works (e.g. updating a Secret referenced in a Deployment does not trigger an update of the Deployment's pods).