Skip to content

Deprioritize resync operations#728

Open
alandiegosantos wants to merge 1 commit intocert-manager:mainfrom
alandiegosantos:depriority_resync
Open

Deprioritize resync operations#728
alandiegosantos wants to merge 1 commit intocert-manager:mainfrom
alandiegosantos:depriority_resync

Conversation

@alandiegosantos
Copy link
Copy Markdown

@alandiegosantos alandiegosantos commented Jan 31, 2026

In this controller, the re-sync of the istio-ca-root configmap is not a priority compared with the events derived from namespace operations or the change in the root CA. The resync might take tenths of minutes in clusters with thousands of namespaces, slowing the provisioning of the configmap on new namespaces.

So, this MR updates the controller to use WithLowPriorityWhenUnchanged, reducing the priority of the re-sync if the configmap is unchanged. PriorityQueues are default in controller-runtime v0.23, so no other change is necessary.

@cert-manager-prow cert-manager-prow Bot added the dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. label Jan 31, 2026
@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow Bot commented Jan 31, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign thatsmrtalbot for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cert-manager-prow cert-manager-prow Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 31, 2026
@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow Bot commented Jan 31, 2026

Hi @alandiegosantos. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@cert-manager-prow cert-manager-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jan 31, 2026
@alandiegosantos
Deprioritize resync operations
6d1af78 
In this controller, the resync of the istio-ca-root configmap is not a priority compared with the events derived from namespace operations or change in the root CA. The resync operation also impacts clusters with thousands of namespaces, taking tenths of minutes to loop through all the configmaps, slowing the provisioning of the configmap on new namespaces.

So, this MR updates the controller to use WithLowPriorityWhenUnchanged, reducing the priority of the resync if the configmap is unchanged. The PriorityQueue are default in controller-runtime v0.23, so no other change is necessary.

Signed-off-by: Alan Diego dos Santos <alandiegosantos@gmail.com>
@erikgb erikgb requested a review from Copilot February 26, 2026 17:24
Copilot AI reviewed Feb 26, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the ConfigMap controller’s event handling to deprioritize expensive resync/list-driven reconciles when the istio-ca-root-cert ConfigMap content is unchanged, improving responsiveness for namespace-driven provisioning on large clusters.

Changes:

  • Switch the ConfigMap watch from For(...) to an explicit Watches(...) so the handler can be wrapped.
  • Wrap EnqueueRequestForObject with handler.WithLowPriorityWhenUnchanged to reduce priority for unchanged resync/list events.
  • Keep metadata-only caching and the existing name-based predicate for the target ConfigMap.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@SgtCoDFish
Copy link
Copy Markdown
Member

SgtCoDFish commented Feb 26, 2026

/ok-to-test

@cert-manager-prow cert-manager-prow Bot added ok-to-test and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 26, 2026
@alandiegosantos
Copy link
Copy Markdown
Author

alandiegosantos commented Feb 27, 2026

/retest

@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow Bot commented Feb 27, 2026

@alandiegosantos: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-cert-manager-istio-csr-test-ecc 6d1af78 link true /test pull-cert-manager-istio-csr-test-ecc
pull-cert-manager-istio-csr-istio-v1-27 6d1af78 link true /test pull-cert-manager-istio-csr-istio-v1-27
pull-cert-manager-istio-csr-ca-rotation 6d1af78 link true /test pull-cert-manager-istio-csr-ca-rotation
pull-cert-manager-istio-csr-istio-v1-29 6d1af78 link true /test pull-cert-manager-istio-csr-istio-v1-29
pull-cert-manager-istio-csr-pure-runtime 6d1af78 link true /test pull-cert-manager-istio-csr-pure-runtime
pull-cert-manager-istio-csr-istio-ambient 6d1af78 link true /test pull-cert-manager-istio-csr-istio-ambient
pull-cert-manager-istio-csr-istio-v1-28 6d1af78 link true /test pull-cert-manager-istio-csr-istio-v1-28
pull-cert-manager-istio-csr-pure-runtime-config 6d1af78 link true /test pull-cert-manager-istio-csr-pure-runtime-config

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@ciaccotaco
Copy link
Copy Markdown

ciaccotaco commented Mar 2, 2026 •
edited
Loading

I tried to test this locally and got the following error. It is probably the same reason the tests are all failing.

Error: failed to add CA root controller: one of For() or Named() must be called

Coincidentally, I recently implemented changes in my environment to solve the same problem and created PR 752 with how I approached it.

This pull request and my pull request do two different things. I think if this pull request can be updated to eliminate the error, then both can live side by side.

  • PR 728 (this PR) improves queue fairness and startup scalability.
  • PR 752 (Cache Root CA Bundle in ConfigMap Controller) caches the Root CA bundle to reduce per-reconcile overhead.

@cert-manager-prow cert-manager-prow Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 4, 2026
@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow Bot commented Mar 4, 2026

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. ok-to-test size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@alandiegosantos @SgtCoDFish @ciaccotaco