k8snetworkplumbingwg / multus-cni / 22876403658

50%

master: 50%

Pull #1482

github

Fix certificate rotation race condition in per-node certificates

Add exponential backoff retry logic to handle transient certificate errors
during daemon startup. This prevents crash-loops when pods restart during
the certificate rotation window (~3 seconds) where the symlink is temporarily
removed or the file is empty.

We accomplish this by retrying if we get a tranient error, but still
fail fast on permanent errors such as an RBAC issue or NoCertKey error

Changes:
- Add isTransientCertError() to classify errors as transient vs permanent
- Add exponential backoff retry (100ms, 200ms, 400ms, 800ms, 1.6s) within
  the existing 2-minute CSR approval timeout
- Transient errors (PathError, 'failed to find any PEM data', etc.) are
  retried automatically
- Permanent errors (NoCertKeyError, RBAC issues) fail fast as before
- Add verbose logging on successful retry to aid debugging

Testing
- Tested with missing certificate file during pod restart
- Pods successfully recover and start normally
- All existing unit tests pass (44/44)

Assisted by Claude Sonnet 4.5

Signed-off-by: Benjamin Pickard <bpickard@redhat.com>

8 of 81 new or added lines in 4 files covered. (9.88%)

2509 of 5057 relevant lines covered (49.61%)

6.13 hits per line