When the bundle controller updates a BundleDeployment, it writes the BD secret (manageOptionsSecret) before writing the BD spec (createBundleDeployment). If the spec write fails (e.g., optimistic concurrency conflict), the secret holds new values while the BD still carries the old ValuesHash.
The hash guard in Targets() then detects the mismatch and returns an error that gets wrapped as TerminalError — no requeue, no retry. Because manageOptionsSecret only runs after Targets() succeeds, there is no recovery path. The BD stays stuck permanently.
When the bundle controller updates a BundleDeployment, it writes the BD secret (manageOptionsSecret) before writing the BD spec (createBundleDeployment). If the spec write fails (e.g., optimistic concurrency conflict), the secret holds new values while the BD still carries the old ValuesHash.
The hash guard in Targets() then detects the mismatch and returns an error that gets wrapped as TerminalError — no requeue, no retry. Because manageOptionsSecret only runs after Targets() succeeds, there is no recovery path. The BD stays stuck permanently.