OCPBUGS-60045: certrotation: exit when received cabundle is empty

[vrutkovs]

When different controllers update the same CA bundle a conflict may occur. In that case we return an empty set of certificates and empty error.

The sync procedure should exit if either non-empty error received or cabundle is empty, as this ca bundle is later used to detemine whether target cert can be verified. If conflict occurred during CA bundle update we should restart the sync worker again - otherwise this may lead to target certificate unexpectedly regenerated. When service network target certificate is being updated it may be fatal, as the operator will lose its connection to API server and won't be able to receive an updated certificate.

[openshift-ci-robot]

@vrutkovs: This pull request references Jira Issue OCPBUGS-60045, which is invalid:

• expected the bug to target the "4.20.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

When different controllers update the same CA bundle a conflict may occur. In that case we return an empty set of certificates and empty error.

The sync procedure should exit if either non-empty error received or cabundle is empty, as this ca bundle is later used to detemine whether target cert can be verified. If conflict occurred during CA bundle update we should restart the sync worker again - otherwise this may lead to target certificate unexpectedly regenerated. When service network target certificate is being updated it may be fatal, as the operator will lose its connection to API server and won't be able to receive an updated certificate.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[vrutkovs]

/jira refresh

[openshift-ci-robot]

@vrutkovs: This pull request references Jira Issue OCPBUGS-60045, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.20.0) matches configured target version for branch (4.20.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[wangke19]

This change looks solid. It addresses a potential race condition where an empty CA bundle could cause unexpected certificate regeneration. By explicitly checking for nil signingCertKeyPair and
cabundleCerts and returning an error, the sync process will be forced to retry, which is the correct behavior in this scenario.

The addition of client_cert_rotation_controller_test.go is excellent. It includes thorough test cases that cover the new error conditions, ensuring the fix is robust and well-tested.

Gemini advice: This is a good change. I'd recommend merging it. The logic is sound, and the tests are comprehensive.

I also agree.
/lgtm

[wangke19]

/assign @jsafrane

[jsafrane]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jsafrane, vrutkovs, wangke19

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/operator/OWNERS [jsafrane]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@vrutkovs: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@vrutkovs: Jira Issue OCPBUGS-60045: All pull requests linked via external trackers have merged:

• openshift/library-go#2004

Jira Issue OCPBUGS-60045 has been moved to the MODIFIED state.

In response to this:

When different controllers update the same CA bundle a conflict may occur. In that case we return an empty set of certificates and empty error.

The sync procedure should exit if either non-empty error received or cabundle is empty, as this ca bundle is later used to detemine whether target cert can be verified. If conflict occurred during CA bundle update we should restart the sync worker again - otherwise this may lead to target certificate unexpectedly regenerated. When service network target certificate is being updated it may be fatal, as the operator will lose its connection to API server and won't be able to receive an updated certificate.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[vrutkovs]

/cherrypick release-4.20

[openshift-cherrypick-robot]

@vrutkovs: new pull request created: #2022

In response to this:

/cherrypick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.