Although the apiext server has CA bundle it might not have been injected into the CRD. Unfortunatelly, there is no good Condition/Readiness check on the CRD to ensure it has been patched correctly.
This causes a race condition when using something like Helm because the apiext pod will say it is ready because it has a CA cert but the CA bundle might not have been picked up by the k8s api-extension server.
This adds an additional check to the Ready Probe to validate both that we have a CA Cert and in fact it matches the CA bundle in the CRD's. Since we are using the controller-runtime Manager client which caches this List this will be a low latency way to ensure the CRD's are patched and ready as well.
For example, the test now takes a little longer for the apiext replicas to come ready but we can be confident that when we try to apply the Listener and Mapping that both are ready.
If not previously due to the race condition, we would see a few retries on the Mapping due to CABundle not being available and unable to validate self-signed server certificate.
Description
Although the apiext server has CA bundle it might not have been injected into the CRD. Unfortunatelly, there is no good Condition/Readiness check on the CRD to ensure it has been patched correctly.
This causes a race condition when using something like Helm because the apiext pod will say it is ready because it has a CA cert but the CA bundle might not have been picked up by the k8s api-extension server.
This adds an additional check to the Ready Probe to validate both that we have a CA Cert and in fact it matches the CA bundle in the CRD's. Since we are using the controller-runtime Manager client which caches this List this will be a low latency way to ensure the CRD's are patched and ready as well.
For example, the test now takes a little longer for the apiext replicas to come ready but we can be confident that when we try to apply the Listener and Mapping that both are ready.
If not previously due to the race condition, we would see a few retries on the
Mappingdue to CABundle not being available and unable to validate self-signed server certificate.Related Issues
N/A
Testing
No additional testing added, current e2e test coverage already exercises it.
Checklist
CHANGELOG.md.DEVELOPING.mdwith any any special dev tricks I had to use to work on this code efficiently.