From f9b24d047869f0c75852f5e401d53027757bcefa Mon Sep 17 00:00:00 2001 From: cgong Date: Thu, 23 Jul 2026 21:22:14 +1200 Subject: [PATCH] fix: safe type assertion in secret controller UpdateFunc Unchecked type assertions on e.ObjectOld and e.ObjectNew panic if the watch cache delivers a non-Secret object (e.g. during cache warm-up or a DeletedFinalStateUnknown tombstone). Guard both assertions and return false when either fails, matching controller-runtime best practice. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- controllers/secret/secret_controller.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/controllers/secret/secret_controller.go b/controllers/secret/secret_controller.go index 499814be..8b4a0507 100644 --- a/controllers/secret/secret_controller.go +++ b/controllers/secret/secret_controller.go @@ -31,7 +31,12 @@ func mySecretPredicate() predicate.Predicate { CreateFunc: func(e event.CreateEvent) bool { return passes(e.Object) }, DeleteFunc: func(e event.DeleteEvent) bool { return e.Object.GetName() == config.SplunkHECTokenSecretName }, UpdateFunc: func(e event.UpdateEvent) bool { - return passes(e.ObjectOld) && dataChanged(e.ObjectOld.(*corev1.Secret), e.ObjectNew.(*corev1.Secret)) + oldSecret, oldOk := e.ObjectOld.(*corev1.Secret) + newSecret, newOk := e.ObjectNew.(*corev1.Secret) + if !oldOk || !newOk { + return false + } + return passes(e.ObjectOld) && dataChanged(oldSecret, newSecret) }, GenericFunc: func(e event.GenericEvent) bool { return passes(e.Object) }, }