fix: fix operator race condition (#6929)

Signed-off-by: Julien Mancuso <jmancuso@nvidia.com>

deploy/operator/internal/cert/cert.go

@@ -131,8 +131,13 @@ func (cm *CertManager) setupAutoProvisioning(ctx context.Context, mgr ctrl.Manag
 			fmt.Sprintf("%s.%s", cm.cfg.ServiceName, cm.namespace),
 			fmt.Sprintf("%s.%s.svc.cluster.local", cm.cfg.ServiceName, cm.namespace),
 		},
-		EnableReadinessCheck:   true,
-		RestartOnSecretRefresh: true,
+		EnableReadinessCheck: true,
+		// RestartOnSecretRefresh is intentionally false (default). The rotator's
+		// ensureCertsMounted goroutine polls CertDir until the kubelet projects
+		// the updated secret, then closes IsReady. The webhook server is only
+		// started after IsReady fires, so the files are guaranteed to exist.
+		// Setting this to true would call os.Exit immediately after writing the
+		// secret, racing the kubelet volume projection on restart.
 	}
 	return cm.provisioner.AddRotator(mgr, rotator)
 }

deploy/operator/internal/cert/cert_test.go

@@ -185,8 +185,7 @@ func TestCertManager_AutoModeConfiguresRotator(t *testing.T) {
 			fmt.Sprintf("%s.%s", testServiceName, testNamespace),
 			fmt.Sprintf("%s.%s.svc.cluster.local", testServiceName, testNamespace),
 		},
-		EnableReadinessCheck:   true,
-		RestartOnSecretRefresh: true,
+		EnableReadinessCheck: true,
 	}
 
 	if !reflect.DeepEqual(prov.capturedArgs, expected) {