From 2efca8893cef87f3b1f4ff0666a88360da9b046b Mon Sep 17 00:00:00 2001 From: Mukul Date: Sat, 18 Jul 2026 23:41:27 +0530 Subject: [PATCH 1/3] Fail loudly when renew-certificate --restart cannot restart the control plane dapr mtls renew-certificate --restart discarded the error returned by restartControlPlaneService and checked a stale err variable that is always nil at that point, so a failed control-plane restart still reported success with exit code 0. A namespace lookup failure was also ignored, producing 'kubectl rollout restart -n ""'. The restart list additionally omitted statefulsets/dapr-scheduler-server, which is part of the control plane since runtime 1.14 (reported in #1574). The scheduler is restarted only when present so older clusters are unaffected. Fixes #1669 Signed-off-by: Mukul --- cmd/renew_certificate.go | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/cmd/renew_certificate.go b/cmd/renew_certificate.go index 5c5e281916..fa179b6208 100644 --- a/cmd/renew_certificate.go +++ b/cmd/renew_certificate.go @@ -132,9 +132,8 @@ dapr mtls renew-cert -k --valid-until --restart "Certificate rotation is successful! Your new certicate is valid through "+expiry.Format(time.RFC1123)) if restartDaprServices { - restartControlPlaneService() - if err != nil { - print.FailureStatusEvent(os.Stdout, err.Error()) + if err := restartControlPlaneService(); err != nil { + print.FailureStatusEvent(os.Stderr, err.Error()) os.Exit(1) } } @@ -170,15 +169,21 @@ func logErrorAndExit(err error) { } func restartControlPlaneService() error { + namespace, err := kubernetes.GetDaprNamespace() + if err != nil { + return fmt.Errorf("failed to fetch Dapr namespace: %w", err) + } + controlPlaneServices := []string{ "deploy/dapr-sentry", "deploy/dapr-sidecar-injector", "deploy/dapr-operator", "statefulsets/dapr-placement-server", } - namespace, err := kubernetes.GetDaprNamespace() - if err != nil { - print.FailureStatusEvent(os.Stdout, "Failed to fetch Dapr namespace") + // The scheduler control plane service only exists for runtime 1.14 onwards, + // so restart it only when it is present in the cluster. + if _, err := utils.RunCmdAndWait("kubectl", "get", "statefulsets/dapr-scheduler-server", "-n", namespace); err == nil { + controlPlaneServices = append(controlPlaneServices, "statefulsets/dapr-scheduler-server") } errs := make([]error, len(controlPlaneServices)) From 339975feeb653034a5787fbe90299159cb7dfee9 Mon Sep 17 00:00:00 2001 From: Mukul Date: Sun, 19 Jul 2026 00:10:53 +0530 Subject: [PATCH 2/3] Address review: constant format string and resource-agnostic restart errors Signed-off-by: Mukul --- cmd/renew_certificate.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/renew_certificate.go b/cmd/renew_certificate.go index fa179b6208..d3b9034455 100644 --- a/cmd/renew_certificate.go +++ b/cmd/renew_certificate.go @@ -133,7 +133,7 @@ dapr mtls renew-cert -k --valid-until --restart if restartDaprServices { if err := restartControlPlaneService(); err != nil { - print.FailureStatusEvent(os.Stderr, err.Error()) + print.FailureStatusEvent(os.Stderr, "%s", err.Error()) os.Exit(1) } } @@ -195,12 +195,12 @@ func restartControlPlaneService() error { print.InfoStatusEvent(os.Stdout, fmt.Sprintf("Restarting %s..", name)) _, err := utils.RunCmdAndWait("kubectl", "rollout", "restart", "-n", namespace, name) if err != nil { - errs[i] = fmt.Errorf("error in restarting deployment %s. Error is %w", name, err) + errs[i] = fmt.Errorf("error in restarting %s. Error is %w", name, err) return } _, err = utils.RunCmdAndWait("kubectl", "rollout", "status", "-n", namespace, name) if err != nil { - errs[i] = fmt.Errorf("error in checking status for deployment %s. Error is %w", name, err) + errs[i] = fmt.Errorf("error in checking rollout status for %s. Error is %w", name, err) return } }(i, name) From dc167c630431c95256180d8ad4726170ac9641b1 Mon Sep 17 00:00:00 2001 From: Mukul Date: Tue, 28 Jul 2026 00:56:21 +0530 Subject: [PATCH 3/3] Only treat NotFound as scheduler absence in restart probe The presence probe treated any kubectl get failure as 'scheduler absent', so an RBAC or transient API error would silently skip the scheduler restart. Use --ignore-not-found -o name so absence is the only non-error outcome with empty output, and propagate every other probe failure so --restart fails loudly. Signed-off-by: Mukul --- cmd/renew_certificate.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/cmd/renew_certificate.go b/cmd/renew_certificate.go index d3b9034455..14dcec4955 100644 --- a/cmd/renew_certificate.go +++ b/cmd/renew_certificate.go @@ -181,8 +181,15 @@ func restartControlPlaneService() error { "statefulsets/dapr-placement-server", } // The scheduler control plane service only exists for runtime 1.14 onwards, - // so restart it only when it is present in the cluster. - if _, err := utils.RunCmdAndWait("kubectl", "get", "statefulsets/dapr-scheduler-server", "-n", namespace); err == nil { + // so restart it only when it is present in the cluster. --ignore-not-found + // makes absence the only non-error outcome with empty output: any other + // probe failure (RBAC, transient API error) must fail the restart loudly + // rather than silently skipping the scheduler. + out, err := utils.RunCmdAndWait("kubectl", "get", "statefulsets/dapr-scheduler-server", "-n", namespace, "--ignore-not-found", "-o", "name") + if err != nil { + return fmt.Errorf("failed to check for dapr-scheduler-server statefulset: %w", err) + } + if strings.TrimSpace(out) != "" { controlPlaneServices = append(controlPlaneServices, "statefulsets/dapr-scheduler-server") }