From 0ded4b5399fbb581891f2a34ec0196f403cd4d70 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Sun, 28 Jun 2026 22:00:59 +0000 Subject: [PATCH 1/2] TRT-2761: Make applyClusterTLSProfile() non-fatal to prevent packageserver crash-loops in HyperShift PR #1330 introduced applyClusterTLSProfile() in the packageserver startup path that makes API calls with a hard timeout. If any call fails (e.g. because the API server is not yet ready during HyperShift hosted cluster bootstrap), the function returns a fatal error that crashes the container. This causes an infinite crash-loop that blocks cluster creation. Make the failure non-fatal by logging a warning instead of returning an error. This is safe because: - The Package Server Manager (PSM) will inject the correct TLS flags (--tls-min-version, --tls-cipher-suites) on its next reconciliation - Default TLS settings are safe and compliant - The packageserver must be able to start even when the API server is temporarily unavailable Also reduce the best-effort lookup timeout from 30s to 10s to avoid blocking startup unnecessarily. Co-Authored-By: Claude Opus 4.6 --- .../pkg/package-server/server/server.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/staging/operator-lifecycle-manager/pkg/package-server/server/server.go b/staging/operator-lifecycle-manager/pkg/package-server/server/server.go index a6e8a3216c..0e84a6a967 100644 --- a/staging/operator-lifecycle-manager/pkg/package-server/server/server.go +++ b/staging/operator-lifecycle-manager/pkg/package-server/server/server.go @@ -225,9 +225,13 @@ func (o *PackageServerOptions) Run(ctx context.Context) error { // If --tls-min-version was not supplied (e.g. no PSM-injected flags yet), fall // back to a direct GET of the cluster APIServer CR so the packageserver still // honours the cluster TLS security profile on first boot or during upgrades. + // Failure is non-fatal: the packageserver must be able to start even when the + // API server is temporarily unreachable (e.g. HyperShift hosted cluster + // bootstrap). The Package Server Manager (PSM) will reconcile the correct + // TLS flags on its next sync. if o.SecureServing.MinTLSVersion == "" { if err := applyClusterTLSProfile(ctx, clientConfig, o.SecureServing); err != nil { - return fmt.Errorf("failed to apply cluster TLS profile to serving options: %w", err) + log.Warningf("Failed to apply cluster TLS profile (will use defaults, PSM will reconcile correct settings): %v", err) } } @@ -348,7 +352,7 @@ func (op *Operator) syncOLMConfig(obj interface{}) error { // This is the fallback path used when --tls-min-version is not provided via flags // (i.e. before the PSM has had a chance to inject them). func applyClusterTLSProfile(ctx context.Context, config *rest.Config, serving *genericoptions.SecureServingOptionsWithLoopback) error { - const lookupTimeout = 30 * time.Second + const lookupTimeout = 10 * time.Second profileCtx, cancel := context.WithTimeout(ctx, lookupTimeout) defer cancel() From d9bd919ff175bcc438abe634ecd40928616ebc26 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Sun, 28 Jun 2026 22:14:37 +0000 Subject: [PATCH 2/2] TRT-2761: Sync vendor copy of packageserver server.go Update the vendored copy to match the staging changes that make applyClusterTLSProfile() non-fatal and reduce the lookup timeout. Co-Authored-By: Claude Opus 4.6 --- .../pkg/package-server/server/server.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/package-server/server/server.go b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/package-server/server/server.go index a6e8a3216c..0e84a6a967 100644 --- a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/package-server/server/server.go +++ b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/package-server/server/server.go @@ -225,9 +225,13 @@ func (o *PackageServerOptions) Run(ctx context.Context) error { // If --tls-min-version was not supplied (e.g. no PSM-injected flags yet), fall // back to a direct GET of the cluster APIServer CR so the packageserver still // honours the cluster TLS security profile on first boot or during upgrades. + // Failure is non-fatal: the packageserver must be able to start even when the + // API server is temporarily unreachable (e.g. HyperShift hosted cluster + // bootstrap). The Package Server Manager (PSM) will reconcile the correct + // TLS flags on its next sync. if o.SecureServing.MinTLSVersion == "" { if err := applyClusterTLSProfile(ctx, clientConfig, o.SecureServing); err != nil { - return fmt.Errorf("failed to apply cluster TLS profile to serving options: %w", err) + log.Warningf("Failed to apply cluster TLS profile (will use defaults, PSM will reconcile correct settings): %v", err) } } @@ -348,7 +352,7 @@ func (op *Operator) syncOLMConfig(obj interface{}) error { // This is the fallback path used when --tls-min-version is not provided via flags // (i.e. before the PSM has had a chance to inject them). func applyClusterTLSProfile(ctx context.Context, config *rest.Config, serving *genericoptions.SecureServingOptionsWithLoopback) error { - const lookupTimeout = 30 * time.Second + const lookupTimeout = 10 * time.Second profileCtx, cancel := context.WithTimeout(ctx, lookupTimeout) defer cancel()