From 588872989ebee5f8175e935024e3e9dc07d5ef35 Mon Sep 17 00:00:00 2001 From: Ugo Giordano Date: Thu, 16 Jul 2026 13:35:47 +0200 Subject: [PATCH] fix: add TLSOpts to EvalHub webhook, handle transient TLS errors Applies TLSOpts to the EvalHub webhook server override that was previously missing them, and adds handling for context.DeadlineExceeded and apierrors.IsServerTimeout in the TLS profile resolution to prevent crash loops during transient API server issues. Signed-off-by: Ugo Giordano Co-Authored-By: Claude Opus 4.6 (1M context) --- cmd/main.go | 3 ++- pkg/tls/tls.go | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/cmd/main.go b/cmd/main.go index 4d2cf0c7f..40d995256 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -151,7 +151,8 @@ func main() { if slices.Contains(enabledServices, serviceEvalHub) { mgrOpts.WebhookServer = ctrlwebhook.NewServer(ctrlwebhook.Options{ - Port: 9443, + Port: 9443, + TLSOpts: tlsOpts, }) } diff --git a/pkg/tls/tls.go b/pkg/tls/tls.go index 7c94da078..357dcbc1a 100644 --- a/pkg/tls/tls.go +++ b/pkg/tls/tls.go @@ -19,6 +19,7 @@ package tls import ( "context" "crypto/tls" + "errors" "fmt" "time" @@ -102,10 +103,12 @@ func Resolve(ctx context.Context, cfg *rest.Config) (Result, error) { log.Info("APIServer resource not found, using hardened defaults") case apierrors.IsServiceUnavailable(err): log.Info("API server unavailable, using hardened defaults", "error", err) - case apierrors.IsTimeout(err): + case apierrors.IsTimeout(err), apierrors.IsServerTimeout(err): log.Info("API server request timed out, using hardened defaults", "error", err) case apierrors.IsTooManyRequests(err): log.Info("API server throttled request, using hardened defaults", "error", err) + case errors.Is(err, context.DeadlineExceeded): + log.Info("API server request deadline exceeded, using hardened defaults", "error", err) default: return result, fmt.Errorf("failed to read APIServer TLS profile: %w", err) }