fix: requeue on now or in the past

Author: zachsmith1

internal/controller/domain_controller.go

@@ -147,8 +147,14 @@ func (r *DomainReconciler) Reconcile(ctx context.Context, req mcreconcile.Reques
 		}
 	}
 
-	if wake != nil && wake.After(now) {
-		return ctrl.Result{RequeueAfter: wake.Sub(now).Truncate(time.Second)}, nil
+	if wake != nil {
+		// If the wake time is in the future, schedule a requeue after the remaining duration.
+		if wake.After(now) {
+			return ctrl.Result{RequeueAfter: wake.Sub(now).Truncate(time.Second)}, nil
+		}
+		// If the wake time is now or already in the past, use a minimal positive RequeueAfter
+		// to avoid the deprecated Requeue flag.
+		return ctrl.Result{RequeueAfter: 1 * time.Second}, nil
 	}
 
 	return ctrl.Result{}, nil

internal/controller/domain_controller_test.go

@@ -556,6 +556,128 @@ func TestRegistration_Apex_UsesRDAPNameservers(t *testing.T) {
 	assert.True(t, res.RequeueAfter > 0)
 }
 
+func TestVerification_RequeueImmediate_WhenWakeDueOrPast(t *testing.T) {
+	s := runtime.NewScheme()
+	_ = scheme.AddToScheme(s)
+	_ = networkingv1alpha.AddToScheme(s)
+
+	// Fixed reference time
+	now := time.Date(2025, 10, 22, 15, 40, 14, 0, time.UTC)
+
+	// Domain has existing verification scaffold and next attempt is due NOW
+	dom := newDomain("default", "due-now", func(d *networkingv1alpha.Domain) {
+		d.Status.Verification = &networkingv1alpha.DomainVerificationStatus{
+			DNSRecord: networkingv1alpha.DNSVerificationRecord{
+				Name:    "_dnsverify.example.com",
+				Type:    "TXT",
+				Content: "token",
+			},
+			NextVerificationAttempt: metav1.Time{Time: now},
+		}
+	})
+
+	cl := fake.NewClientBuilder().WithScheme(s).WithObjects(dom).WithStatusSubresource(dom).Build()
+	mgr := &fakeMockManager{cl: cl}
+
+	// Configure zero retry interval and zero jitter to force nextAttempt == now
+	operatorConfig := config.NetworkServicesOperator{
+		DomainVerification: config.DomainVerificationConfig{
+			RetryIntervals:       []config.RetryInterval{{Interval: metav1.Duration{Duration: 0}}},
+			RetryJitterMaxFactor: 0,
+		},
+		DomainRegistration: config.DomainRegistrationConfig{ // prevent nil panics in registration
+			LookupTimeout:   &metav1.Duration{Duration: 3 * time.Second},
+			RefreshInterval: &metav1.Duration{Duration: time.Hour},
+			JitterMaxFactor: 0.1,
+			RetryBackoff:    &metav1.Duration{Duration: time.Minute},
+		},
+	}
+
+	r := &DomainReconciler{
+		mgr:     mgr,
+		Config:  operatorConfig,
+		timeNow: func() time.Time { return now },
+		// Stubs to avoid real I/O
+		httpGet: func(ctx context.Context, url string) ([]byte, *http.Response, error) {
+			return nil, nil, fmt.Errorf("not implemented")
+		},
+		lookupTXT: func(ctx context.Context, name string) ([]string, error) { return nil, &net.DNSError{IsNotFound: true} },
+		rdapDo: func(ctx context.Context, req *rdap.Request) (*rdap.Response, error) {
+			return &rdap.Response{Object: &rdap.Domain{LDHName: "example.com"}}, nil
+		},
+		lookupNS:    func(ctx context.Context, name string) ([]*net.NS, error) { return nil, &net.DNSError{IsNotFound: true} },
+		lookupIP:    func(ctx context.Context, name string) ([]net.IPAddr, error) { return nil, nil },
+		rdapQueryIP: func(ctx context.Context, ip string) (*rdap.IPNetwork, error) { return nil, nil },
+	}
+
+	res, err := r.Reconcile(context.Background(), mcreconcile.Request{ClusterName: "test", Request: reconcile.Request{NamespacedName: client.ObjectKeyFromObject(dom)}})
+	assert.NoError(t, err)
+
+	// With the fix, we should requeue immediately when wake time is now/past
+	assert.Equal(t, time.Duration(1*time.Second), res.RequeueAfter)
+}
+
+func TestVerification_RequeueImmediate_WhenWakeInPast(t *testing.T) {
+	s := runtime.NewScheme()
+	_ = scheme.AddToScheme(s)
+	_ = networkingv1alpha.AddToScheme(s)
+
+	// Fixed reference time
+	now := time.Date(2025, 10, 22, 15, 40, 14, 0, time.UTC)
+
+	// Domain has existing verification scaffold and next attempt was due 1s ago
+	dom := newDomain("default", "due-past", func(d *networkingv1alpha.Domain) {
+		d.Status.Verification = &networkingv1alpha.DomainVerificationStatus{
+			DNSRecord: networkingv1alpha.DNSVerificationRecord{
+				Name:    "_dnsverify.example.com",
+				Type:    "TXT",
+				Content: "token",
+			},
+			NextVerificationAttempt: metav1.Time{Time: now.Add(-1 * time.Second)},
+		}
+	})
+
+	cl := fake.NewClientBuilder().WithScheme(s).WithObjects(dom).WithStatusSubresource(dom).Build()
+	mgr := &fakeMockManager{cl: cl}
+
+	operatorConfig := config.NetworkServicesOperator{
+		DomainVerification: config.DomainVerificationConfig{
+			RetryIntervals:       []config.RetryInterval{{Interval: metav1.Duration{Duration: 0}}},
+			RetryJitterMaxFactor: 0,
+		},
+		DomainRegistration: config.DomainRegistrationConfig{
+			LookupTimeout:   &metav1.Duration{Duration: 3 * time.Second},
+			RefreshInterval: &metav1.Duration{Duration: time.Hour},
+			JitterMaxFactor: 0.1,
+			RetryBackoff:    &metav1.Duration{Duration: time.Minute},
+		},
+	}
+
+	r := &DomainReconciler{
+		mgr:     mgr,
+		Config:  operatorConfig,
+		timeNow: func() time.Time { return now },
+		// Stubs to avoid real I/O
+		httpGet: func(ctx context.Context, url string) ([]byte, *http.Response, error) {
+			return nil, nil, fmt.Errorf("not implemented")
+		},
+		lookupTXT: func(ctx context.Context, name string) ([]string, error) { return nil, &net.DNSError{IsNotFound: true} },
+		rdapDo: func(ctx context.Context, req *rdap.Request) (*rdap.Response, error) {
+			return &rdap.Response{Object: &rdap.Domain{LDHName: "example.com"}}, nil
+		},
+		lookupNS:    func(ctx context.Context, name string) ([]*net.NS, error) { return nil, &net.DNSError{IsNotFound: true} },
+		lookupIP:    func(ctx context.Context, name string) ([]net.IPAddr, error) { return nil, nil },
+		rdapQueryIP: func(ctx context.Context, ip string) (*rdap.IPNetwork, error) { return nil, nil },
+	}
+
+	res, err := r.Reconcile(context.Background(), mcreconcile.Request{ClusterName: "test", Request: reconcile.Request{NamespacedName: client.ObjectKeyFromObject(dom)}})
+	assert.NoError(t, err)
+
+	// With the fix, we should requeue immediately when wake time is past
+	assert.True(t, res.Requeue)
+	assert.Equal(t, time.Duration(0), res.RequeueAfter)
+}
+
 func TestRegistration_Subdomain_DelegationOverridesApexNS(t *testing.T) {
 	s := runtime.NewScheme()
 	_ = scheme.AddToScheme(s)