Repository: kubernetes/kubernetes
File: pkg/kubelet/podcertificate/podcertificatemanager.go (Go)

Code before:
			pcrAbandonAt: pcr.ObjectMeta.CreationTimestamp.Time.Add(assumeDeletedThreshold + jitterDuration()),
		}

		// Return nil to remove the projection from the workqueue --- it will be
		// readded once the PodCertificateRequest appears in the informer cache,
		// and goes through status updates.
		klog.V(4).InfoS("PodCertificateRequest created, moving to credStateWait", "key", key, "pcr", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name)
		return nil

	case *credStateWait:
		// We are working through the initial issuance.  We created a PCR, now
		// we need to wait for it to reach a terminal state.

		pcr, err := m.pcrLister.PodCertificateRequests(key.Namespace).Get(state.pcrName)
		if k8serrors.IsNotFound(err) && m.clock.Now().After(state.pcrAbandonAt) {
			// "Not Found" could be due to informer lag, or because someone
			// deleted the PodCertificateRequest.  In the first case, the
			// correct action is to continue waiting.  In the second case, the
			// correct action is to recreate the PCR.  Properly disambiguating
			// the cases will require resourceVersions to be ordered, and for
			// the lister to report the highest resource version it has seen. In
			// the meantime, assume that if it has been 10 minutes since we
			// remember creating the PCR, then we must be in case 2.  Return to
			// credStateInitial so we create a new PCR.
			rec.curState = &credStateInitial{}
			// Protect against nil dereference when informer lag causes pcr to be nil.
			if pcr == nil {
				return fmt.Errorf("PodCertificateRequest appears to have been deleted (pcr is nil for key %s/%s)", key.Namespace, key.PodName)
			}
			return fmt.Errorf("PodCertificateRequest %q appears to have been deleted", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name)
		} else if err != nil {
			return fmt.Errorf("while getting PodCertificateRequest %q: %w", key.Namespace+"/"+state.pcrName, err)
		}

		// If the PodCertificateRequest has moved to a terminal state, update
		// our state machine accordingly.
		for _, cond := range pcr.Status.Conditions {
			switch cond.Type {
			case certificatesv1beta1.PodCertificateRequestConditionTypeDenied:
				rec.curState = &credStateDenied{
					Reason:  cond.Reason,
					Message: cond.Message,
				}
				klog.V(4).InfoS("PodCertificateRequest denied, moving to credStateDenied", "key", key, "pcr", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name)
				eventMessage := fmt.Sprintf("PodCertificateRequest %s was denied, reason=%q, message=%q", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name, cond.Reason, cond.Message)
				m.recorder.Eventf(pod, corev1.EventTypeWarning, certificatesv1beta1.PodCertificateRequestConditionTypeDenied, cond.Reason, eventMessage)
				return nil
			case certificatesv1beta1.PodCertificateRequestConditionTypeFailed:
				rec.curState = &credStateFailed{
					Reason:  cond.Reason,
					Message: cond.Message,

Review comment (suggestion):
If err is non-nil, we shouldn't read the pcr. please use `key.Namespace` and `state.pcrName` instead.

Code after:
			pcrAbandonAt: pcr.ObjectMeta.CreationTimestamp.Time.Add(assumeDeletedThreshold + jitterDuration()),
		}

		// Return nil to remove the projection from the workqueue --- it will be
		// readded once the PodCertificateRequest appears in the informer cache,
		// and goes through status updates.
		klog.V(4).InfoS("PodCertificateRequest created, moving to credStateWait", "key", key, "pcr", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name)
		return nil

	case *credStateWait:
		// We are working through the initial issuance.  We created a PCR, now
		// we need to wait for it to reach a terminal state.

		pcr, err := m.pcrLister.PodCertificateRequests(key.Namespace).Get(state.pcrName)
		if k8serrors.IsNotFound(err) && m.clock.Now().After(state.pcrAbandonAt) {
			// "Not Found" could be due to informer lag, or because someone
			// deleted the PodCertificateRequest.  In the first case, the
			// correct action is to continue waiting.  In the second case, the
			// correct action is to recreate the PCR.  Properly disambiguating
			// the cases will require resourceVersions to be ordered, and for
			// the lister to report the highest resource version it has seen. In
			// the meantime, assume that if it has been 10 minutes since we
			// remember creating the PCR, then we must be in case 2.  Return to
			// credStateInitial so we create a new PCR.
			rec.curState = &credStateInitial{}
			return fmt.Errorf("PodCertificateRequest %q appears to have been deleted", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name)
		} else if err != nil {
			return fmt.Errorf("while getting PodCertificateRequest %q: %w", key.Namespace+"/"+state.pcrName, err)
		}

		// If the PodCertificateRequest has moved to a terminal state, update
		// our state machine accordingly.
		for _, cond := range pcr.Status.Conditions {
			switch cond.Type {
			case certificatesv1beta1.PodCertificateRequestConditionTypeDenied:
				rec.curState = &credStateDenied{
					Reason:  cond.Reason,
					Message: cond.Message,
				}
				klog.V(4).InfoS("PodCertificateRequest denied, moving to credStateDenied", "key", key, "pcr", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name)
				eventMessage := fmt.Sprintf("PodCertificateRequest %s was denied, reason=%q, message=%q", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name, cond.Reason, cond.Message)
				m.recorder.Eventf(pod, corev1.EventTypeWarning, certificatesv1beta1.PodCertificateRequestConditionTypeDenied, cond.Reason, eventMessage)
				return nil
			case certificatesv1beta1.PodCertificateRequestConditionTypeFailed:
				rec.curState = &credStateFailed{
					Reason:  cond.Reason,
					Message: cond.Message,
				}
				klog.V(4).InfoS("PodCertificateRequest failed, moving to credStateFailed", "key", key, "pcr", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name)
				eventMessage := fmt.Sprintf("PodCertificateRequest %s failed, reason=%q, message=%q", pcr.ObjectMeta.Namespace+"/"+pcr.ObjectMeta.Name, cond.Reason, cond.Message)
				m.recorder.Eventf(pod, corev1.EventTypeWarning, certificatesv1beta1.PodCertificateRequestConditionTypeFailed, cond.Reason, eventMessage)