Skip to content

fix: assert-polling-error - #2761

Open
FirePheonix wants to merge 1 commit into
kyverno:mainfrom
FirePheonix:fix-assert-polling-error
Open

fix: assert-polling-error#2761
FirePheonix wants to merge 1 commit into
kyverno:mainfrom
FirePheonix:fix-assert-polling-error

Conversation

@FirePheonix

Copy link
Copy Markdown

Explanation

This PR is a bug fix that addresses two related issues with how assert and error operations handle Kubernetes API errors during their polling cycle. Previously, any error other than a NotFound would immediately terminate the operation. Additionally, when the poll terminated due to a hard error (or timeout), that terminal error was completely dropped from the logs in favor of printing a stale object snapshot. This change introduces an IsRetriable helper so that transient server errors safely continue polling, and properly reports the terminal error if the operation times out.

Related issue

Fixes #2758

Proposed Changes

  • Added IsRetriable Helper: Created pkg/engine/operations/internal/errors.go to categorize IsInternalError, IsServiceUnavailable, IsTimeout, IsServerTimeout, IsTooManyRequests, and IsUnexpectedServerError as retriable.
  • Fixed Polling Logic: Updated assert and error operations to check internal.IsRetriable(err) and continue polling.
  • Fixed Error Reporting: Updated multierr accumulation logic to append fmt.Errorf("operation terminated with error: %w", err) at the end of the mismatch output so users can accurately debug terminal errors like timeouts or 403s.
  • Test Coverage: Updated the expected log outputs in assert and error test suites.

Checklist

  • I have read the contributing guidelines.
  • I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
  • This is a bug fix and I have added unit tests that prove my fix is effective.

Further Comments

This change makes Chainsaw significantly more resilient in flaky or overloaded clusters (e.g., during etcd leader elections) by properly honoring the configured timeout rather than failing immediately upon the first API blip.

Signed-off-by: Shubham Singh <shubhsoch@gmail.com>
@FirePheonix
FirePheonix requested a review from a team as a code owner August 3, 2026 11:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] assert stops polling on any non-NotFound API error, and reports a stale mismatch instead of the real error

1 participant