k8snetworkplumbingwg / multus-cni / 26907881970

50%

master: 50%

Pull #1483

github

Fix certificate rotation race condition in per-node certificates

Handle transient certificate errors during daemon startup to prevent
crash-loops when pods restart during the certificate rotation window
(~3 seconds) where the symlink is temporarily removed or the file is
empty.

Changes:
- Add isTransientCertError() to classify errors as transient vs permanent
  using string matching (the cert store wraps errors with %v, destroying
  type information, so errors.As is ineffective here)
- Use errors.As for NoCertKeyError (returned directly, not wrapped) and
  retry it in the poll callback since it is expected during initial
  provisioning and during rotation when the symlink is briefly removed
- Transient errors (file not found, empty/invalid PEM) return (false, nil)
  in the existing 1-second poll, retrying naturally
- Permanent errors fail fast via (false, err) instead of polling for the
  full 2-minute timeout
- Add unit tests for isTransientCertError covering all error cases

Assisted by Claude Opus 4.6

Signed-off-by: Benjamin Pickard <bpickard@redhat.com>

15 of 27 new or added lines in 1 file covered. (55.56%)

2543 of 5055 relevant lines covered (50.31%)

6.29 hits per line