fix: create separate config client to resolve APIServer TLS update conflicts (#3753)

Problem:
The olm-operator fails to receive subsequent APIServer TLS configuration
updates after the initial sync. This is because two SharedInformerFactory
instances were being created from the same client, causing watch conflicts:

1. APIServer TLS factory (created in SetupAPIServerTLSConfig)
2. Proxy factory (created inside the OLM operator)

Both factories watch config.openshift.io resources but don't share watch
state, leading to one factory not receiving all update events.

Solution:
Create a separate configclientset.Interface instance for the operator's
proxy syncer. This ensures each SharedInformerFactory has its own client,
preventing watch conflicts.

Author: anik120

cmd/olm/main.go

@@ -133,9 +133,14 @@ func main() {
 	// create a config that validates we're creating objects with labels
 	validatingConfig := validatingroundtripper.Wrap(config, mgr.GetScheme())
 
-	versionedConfigClient, err := configclientset.NewForConfig(config)
+	// Create separate config client for operator's proxy syncer to avoid
+	// SharedInformerFactory conflicts with the APIServer TLS syncer factory.
+	// The APIServer TLS syncer (in SetupAPIServerTLSConfig) creates its own
+	// factory, and the operator's proxy syncer creates another factory. Using
+	// separate client instances prevents watch conflicts between the two factories.
+	operatorConfigClient, err := configclientset.NewForConfig(config)
 	if err != nil {
-		logger.WithError(err).Fatal("error configuring openshift proxy client")
+		logger.WithError(err).Fatal("error configuring openshift config client for operator")
 	}
 	configClient, err := configv1client.NewForConfig(config)
 	if err != nil {
@@ -189,7 +194,7 @@ func main() {
 		olm.WithMetadataClient(metadataClient),
 		olm.WithOperatorClient(opClient),
 		olm.WithRestConfig(validatingConfig),
-		olm.WithConfigClient(versionedConfigClient),
+		olm.WithConfigClient(operatorConfigClient),
 		olm.WithProtectedCopiedCSVNamespaces(*protectedCopiedCSVNamespaces),
 		olm.WithOpenshiftConfigAPIExists(openshiftConfigAPIExists),
 	)