fix: handle IsServerTimeout in TLS profile resolution

ugiordan · claude · ugiordan · commit c7b9f67678a7 · 2026-07-17T15:33:07.000+02:00
StatusReasonServerTimeout is a distinct Kubernetes error from
StatusReasonTimeout. Without handling it, a server-side API timeout
during TLS profile fetch causes the operator to fail to start instead
of falling back to Intermediate defaults.

Signed-off-by: Ugo Giordano &lt;ugiordan@redhat.com&gt;
Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/infra/feast-operator/cmd/main.go b/infra/feast-operator/cmd/main.go
@@ -139,11 +139,10 @@ func main() {
 		os.Exit(1)
 	}
 
-	bootstrapCtx, cancelBootstrap := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancelBootstrap()
-
 	tlsProfileFetched := false
-	tlsProfile, err := tlspkg.FetchAPIServerTLSProfile(bootstrapCtx, bootstrapClient)
+	profileCtx, cancelProfile := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancelProfile()
+	tlsProfile, err := tlspkg.FetchAPIServerTLSProfile(profileCtx, bootstrapClient)
 	if err != nil {
 		switch {
 		case apimeta.IsNoMatchError(err):
@@ -152,10 +151,11 @@ func main() {
 			setupLog.Info("APIServer resource not found, using Intermediate defaults")
 		case apierrors.IsServiceUnavailable(err),
 			apierrors.IsTimeout(err),
+			apierrors.IsServerTimeout(err),
 			apierrors.IsTooManyRequests(err),
 			errors.Is(err, context.DeadlineExceeded):
 			setupLog.Info("Transient API error reading TLS profile, using Intermediate defaults", "error", err)
-			tlsProfileFetched = true // watcher self-heals when the API recovers
+			tlsProfileFetched = true
 		default:
 			setupLog.Error(err, "unable to read APIServer TLS profile, refusing to start with unknown TLS posture")
 			os.Exit(1)
@@ -170,11 +170,15 @@ func main() {
 	}
 	tlsOpts = append(tlsOpts, tlsConfigFn)
 
-	tlsAdherence, err := tlspkg.FetchAPIServerTLSAdherencePolicy(bootstrapCtx, bootstrapClient)
+	tlsAdherenceFetched := false
+	adherenceCtx, cancelAdherence := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancelAdherence()
+	tlsAdherence, err := tlspkg.FetchAPIServerTLSAdherencePolicy(adherenceCtx, bootstrapClient)
 	if err != nil {
 		setupLog.Info("unable to fetch TLS adherence policy, watcher will retry", "error", err)
+	} else {
+		tlsAdherenceFetched = true
 	}
-	tlsAdherenceFetched := true
 
 	tlsOpts = append(tlsOpts, func(c *tls.Config) {
 		c.NextProtos = []string{"h2", "http/1.1"}
