"I don't know" is a state your UI probably doesn't have

Someone discovered two security vulnerabilities in Rubick, a Kubernetes desktop client maintained by the reporter. The more serious issue involved draining a node, which inadvertently evicted pods due to an oversight in the eviction API. The UI mistakenly used a DELETE command when it should have performed an eviction check against the PodDisruptionBudget.

To complicate matters, the UI failed to validate certain conditions, leading to pods being deleted even when a budget refused an eviction. This bug stemmed from the fact that the drain process fell back to a DELETE command upon encountering an error, regardless of the error's nature. The reporter pointed out that the UI displayed misleading information, claiming a drain would wait until another replica became available, while in reality, the pod was deleted unnoticed.

The second issue concerned a Gateway API spec where the status.addresses field was optional. The reporter's code assumed this field would always be filled, but in some implementations, it remained empty. This oversight resulted in the UI reporting that traffic had nowhere to arrive, even when it was not the case. The third bug demonstrated Rubick's tendency to display an "I couldn't see" state instead of providing a clear answer.

The reporter emphasized that absence often looks like evidence, leading to incorrect conclusions when data is incomplete or missing. To resolve the issues, the reporter implemented a fix that added a third state, "blind," to the type system. This state indicated that the source could not be read, distinguishing it from an error or a successful outcome.

By incorporating this additional state, the reporter's app could accurately represent the true condition of the system without misinterpreting absence as evidence of failure.