Follow up to #44, it appears that 4842e47 added the RestartOnSecretRefresh, which restarts the process (os.Exit(0)) every time refreshCerts() is called, to update the Secret.
That said, Kubernetes typically takes ~up to 1 minute delivering the secret to kubelet (easily reproducible on minikube, or kind, or a GKE cluster) with default kubelet configurations.
Since the delivery of updated Secret to the Pod is not instant (or even a duration that can be considered quick), what makes the os.Exit(0) useful if the kubelet will still serve the old Secret upon the restart?
cc: @stijndehaes
Follow up to #44, it appears that 4842e47 added the RestartOnSecretRefresh, which restarts the process (
os.Exit(0)) every timerefreshCerts()is called, to update theSecret.That said, Kubernetes typically takes ~up to 1 minute delivering the secret to kubelet (easily reproducible on minikube, or kind, or a GKE cluster) with default kubelet configurations.
Since the delivery of updated
Secretto the Pod is not instant (or even a duration that can be considered quick), what makes theos.Exit(0)useful if the kubelet will still serve the old Secret upon the restart?cc: @stijndehaes