From ec6e598550b30cc0f3063c46b92080bec2355f53 Mon Sep 17 00:00:00 2001 From: Tom Meadows Date: Tue, 30 Jun 2026 13:39:50 +0100 Subject: [PATCH] kube/certs: widen runCertLoop per-call timeout to 30m (#20289) All issuances serialise through a single mutex in tailscaled. The old 300s timeout fired while a predecessor was legitimately mid-ACME, causing the queued loop to advance retryCount on a non-failure. 30m covers ~15 queued flows and works as a wedge detector against true hangs. Updates #20288 Updates #42164 Signed-off-by: chaosinthecrd --- kube/certs/certs.go | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/kube/certs/certs.go b/kube/certs/certs.go index fd7c82a10..551b9178f 100644 --- a/kube/certs/certs.go +++ b/kube/certs/certs.go @@ -136,11 +136,10 @@ func (cm *CertManager) runCertLoop(ctx context.Context, domain string) { // node's HTTPS endpoint share the same state/renewal lock mechanism, // so we should not run into redundant issuances during concurrent // renewal checks. - - // An issuance holds a shared lock, so we need to avoid a situation - // where other services cannot issue certs because a single one is - // holding the lock. - ctxT, cancel := context.WithTimeout(ctx, time.Second*300) + // + // Long enough to cover queue contention behind tailscaled's + // shared cert mutex; if it fires, something is wedged. + ctxT, cancel := context.WithTimeout(ctx, 30*time.Minute) _, _, err := cm.lc.CertPair(ctxT, domain) cancel() if err != nil {