Dmitry Berkovich e653409b7f podcertcontroller: add flags to raise client-go rate limits (#1421) ...

## Summary

The controller built its Kubernetes client from the default rest.Config,
whose client-side limiter (QPS=5, Burst=10) is shared by every worker of
both signers. Certificate issuance was therefore capped at roughly 5
PodCertificateRequests per second no matter the `--workers-per-signer`
value, and pods in a large rollout sat in FailedMount ("credential
bundle is not issued yet") for the duration: about 2000 seconds for a
10k-pod worker pool in the 1000-node load test.

This adds `--kube-api-qps` and `--kube-api-burst` and applies them to
the config on both the in-cluster and kubeconfig paths. Both default to
0, which leaves client-go's own defaults untouched — behavior only
changes where a deployment opts in. A follow-up PR will set values sized
for large rollouts in
`manifests/ate-install/pod-certificate-controller.yaml`.

## Test plan

- `go build` / `go vet` clean.
- Verified against the 1000-node load test (with raised limits set via
the flags): bundle issuance keeps pace with pod creation instead of
plateauing at ~4.5/sec.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

2026-09-02 16:21:15 -07:00

..

internal

Bump Go to 1.27

2026-08-30 15:43:52 -07:00

main.go

podcertcontroller: add flags to raise client-go rate limits (#1421)

2026-09-02 16:21:15 -07:00