Skip to content

docs: delineate cert health-gating from re-issuance #262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ecv merged 1 commit into from
Jul 13, 2026
+10 −0
Merged

docs: delineate cert health-gating from re-issuance #262

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions internal/controller/gateway_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,11 @@ func (r *GatewayReconciler) ensureDownstreamGateway(

// Evaluate certificate health once so the listener we propagate and the
// status we report to the user can never disagree.
//
// Deliberately separate from fast-track re-issuance (see
// reissueFailedCertificate): this path is read-only and gates on any
// unusable cert, re-issuance mutates and fires only on cert-manager
// hard-fail (LastFailureTime). See #260.
listenerCertHealth := r.evaluateListenerCertHealth(
ctx,
downstreamClient,
Expand Down Expand Up @@ -941,6 +946,11 @@ func (r *GatewayReconciler) ensureListenerCertificates(

// Check if an existing Certificate is stuck in a failed state and
// should be deleted so we can recreate it fresh on the next reconcile.
//
// Deliberately separate from health-gating (see
// evaluateListenerCertHealth): this triggers only on cert-manager
// hard-fail (LastFailureTime), not on every unhealthy cert, since
// expired/missing certs recover via renewal or the isNew path. See #260.
if !isNew {
requeueAfter, gwChanged := r.reissueFailedCertificate(ctx, cert, certName, downstreamGateway, downstreamClient)
if gwChanged {
Expand Down
Loading