test(controller): stop caching Secrets in the envtest manager

[sunib]

The controller envtest suite now wires its manager the way cmd/main.go wires the shipping one: client.CacheOptions{DisableFor: []client.Object{&corev1.Secret{}}}.

Why

The suite's manager cached Secrets; the binary never does. Every controller Secret read in tests was therefore served by a lazily started cluster-wide Secret informer whose view lags the writes the specs make — a divergence that tested a controller that does not ship.

The GitTarget encryption gate reads its age-key Secret by name, and on any error there the target is parked on RequeueSteadyInterval (5 minutes). One stale cache answer — the deleted Secret still present, or a just-created one the informer had not observed — pushed recreation far past the spec's 45-second budget. That is the ~1-in-10 failure of "Should recreate encryption secret when it is deleted while GitTarget still exists" (secrets "recreated-sops-age-key" not found), previously papered over twice by raising that budget.

With live reads, the reconcile after the deletion sees NotFound on the very next RequeueStreamSettleInterval tick, so recreation is bounded by the requeue cadence rather than by informer lag.

Validation

• task lint — pass
• task test — pass (coverage 77.4%, baseline held)
• Focused spec looped 12× — 12 pass

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Updated controller test setup to reflect production behavior when retrieving Secret data.
  • Ensured Secret reads bypass potentially stale cached values during testing.

[coderabbitai]

Warning

Review limit reached

Next included review available in 52 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d212ead6-1d6b-4014-a46d-374f22feab66

📥 Commits

Reviewing files that changed from the base of the PR and between acea892 and a8dbe9f.

📒 Files selected for processing (3)

• docs/TODO.md
• docs/design/watch-plane-status-convergence-failures.md
• internal/controller/gittarget_controller_test.go

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9fcf9e37-97db-486d-9f0a-f3d46de9918b

📥 Commits

Reviewing files that changed from the base of the PR and between fc78c5b and acea892.

📒 Files selected for processing (1)

• internal/controller/suite_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The controller suite test imports the Kubernetes Secret type and disables Secret caching in the test manager. Secret reads now bypass the informer cache, matching the production client configuration.

Changes

Secret cache test configuration

Layer / File(s)	Summary
Disable Secret caching internal/controller/suite_test.go	The test manager excludes corev1.Secret from cache usage. Secret reads are served directly instead of from the informer cache.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to acea8

This test-only change aligns Secret reads with production behavior and removes a cache-related test flake. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description clearly explains the change, cause, impact, and validation results. However, it omits the required Type of Change, Checklist, Related Issues, Screenshots, and Additional Notes sections…	Add the missing template sections. Select the applicable Type of Change and Testing options, complete the Checklist, provide a Related Issues entry or state that none apply, and add Screenshots and Additional Notes entries when applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely states the main change: the controller envtest manager stops caching Secrets.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the change, cause, impact, and validation results. However, it omits the required Type of Change, Checklist, Related Issues, Screenshots, and Additional Notes sections, and it does not provide the requested testing checkboxes.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/encryption-secret-cache-flake

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!