Fix multiple critical issues found in code review:
1. **Namespace handling**: Added explicit namespace from ServiceAccount token
to all kubectl commands. Prevents commands from using wrong default context.
2. **Complete Secret validation**: Now validates both tls.crt AND tls.key fields
with proper checks:
- Certificate: openssl x509 -checkend 0 (validates X.509 and checks expiry)
- Private key: openssl rsa -check (validates RSA key format)
Prevents DataStore creation with incomplete Secrets.
3. **Upgrade support**: Check if DataStore exists before creation. On upgrade,
skip DataStore creation (it already exists). Use kubectl create instead of
apply to prevent accidental spec modifications.
4. **Increased timeout**: Changed from 120s to 300s (5 minutes) and made
configurable via CERT_WAIT_TIMEOUT env var. Accommodates slow cert-manager
processing in production (high load, external CA, resource limits).
5. **Enhanced diagnostics**: Added comprehensive error diagnostics on timeout:
- Certificate CR status
- CertificateRequest status
- Secret contents
- cert-manager controller logs
Significantly improves troubleshooting in production.
6. **Increased retries**: Changed from 3 to 10 retries with explanation.
Provides better tolerance for transient failures (network issues, API
unavailability, resource contention) while avoiding infinite loops.
Total maximum: 10 retries × 30m timeout = 5 hours.
All critical issues from code review are now resolved.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
4ee0b27c7a