1
50%
master: 50%

Ran 09 Mar 2026 09:53PM UTC

Files 26

Run time 1s

Badge

Embed ▾

Committed 09 Mar 2026 09:45PM UTC coverage: 49.614% (-0.6%) from 50.17%

Job # 22876403658.1

Build Type

Pull #1482

github

Committed by

bpickard22

Commit Message

Fix certificate rotation race condition in per-node certificates

Add exponential backoff retry logic to handle transient certificate errors
during daemon startup. This prevents crash-loops when pods restart during
the certificate rotation window (~3 seconds) where the symlink is temporarily
removed or the file is empty.

We accomplish this by retrying if we get a tranient error, but still
fail fast on permanent errors such as an RBAC issue or NoCertKey error

Changes:
- Add isTransientCertError() to classify errors as transient vs permanent
- Add exponential backoff retry (100ms, 200ms, 400ms, 800ms, 1.6s) within
  the existing 2-minute CSR approval timeout
- Transient errors (PathError, 'failed to find any PEM data', etc.) are
  retried automatically
- Permanent errors (NoCertKeyError, RBAC issues) fail fast as before
- Add verbose logging on successful retry to aid debugging

Testing
- Tested with missing certificate file during pod restart
- Pods successfully recover and start normally
- All existing unit tests pass (44/44)

Assisted by Claude Sonnet 4.5

Signed-off-by: Benjamin Pickard <bpickard@redhat.com>

Pull Request Pull Request #1482: Cert fix

Run Details

2509 of 5057 relevant lines covered (49.61%)

6.13 hits per line

k8snetworkplumbingwg / multus-cni / 22876403658 / 1
50%
master: 50%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job Go- - 22876403658.1

k8snetworkplumbingwg / multus-cni / 22876403658 / 1 50% master: 50%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job Go- - 22876403658.1

k8snetworkplumbingwg / multus-cni / 22876403658 / 1
50%
master: 50%

README BADGES
x