feat: Apply Intermediate TLS defaults on API fallback and handle transient errors#6587
Open
ugiordan wants to merge 1 commit into
Open
feat: Apply Intermediate TLS defaults on API fallback and handle transient errors#6587ugiordan wants to merge 1 commit into
ugiordan wants to merge 1 commit into
Conversation
ugiordan
force-pushed
the
feat/tls-intermediate-fallback
branch
3 times, most recently
from
429ac39 to
846c5a6
Compare
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
force-pushed
the
feat/tls-intermediate-fallback
branch
from
846c5a6 to
60296ac
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Follow-up to #6567. Fixes two issues in the TLS profile integration:
Else-only pattern:
NewTLSConfigFromProfilewas only called in the success branch of the TLS profile fetch. On any error path (non-OpenShift cluster, resource not found), no TLS config was applied, leaving the operator running with Go's bare defaults (noMinVersion, no cipher restrictions). This PR movesNewTLSConfigFromProfileoutside the if/else and explicitly falls back toconfigv1.TLSProfiles[TLSProfileIntermediateType]on all error paths.No transient error handling: The error switch only handled
IsNotFoundandIsNoMatchError. Transient API errors (ServiceUnavailable,Timeout,TooManyRequests) hit thedefaultcase and crashed the operator withos.Exit(1). This PR adds a dedicated case for these errors with a graceful Intermediate fallback.tlsProfileFetchedis set totrueso theSecurityProfileWatcherself-heals when the API recovers.Additionally:
context.Background()with no deadline).Which issue(s) this PR fixes:
Follow-up to #6567.
Checks
git commit -s)Testing Strategy
Misc
The operator Go module builds cleanly with
go build ./...frominfra/feast-operator/.