feat: Integrate cluster TLS profile with graceful fallback - #6567

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

…sient errors

Follow-up to feast-dev#6567. Two fixes:

1. Move NewTLSConfigFromProfile outside the if/else so it runs on all
   code paths. Previously, error paths skipped TLS configuration entirely,
   leaving the operator running with Go's bare defaults (no MinVersion,
   no cipher restrictions). Now all error paths explicitly fall back to
   the Intermediate TLS profile.

2. Handle transient API errors (ServiceUnavailable, Timeout,
   TooManyRequests) gracefully instead of crashing with os.Exit(1).
   These set tlsProfileFetched=true so the SecurityProfileWatcher
   self-heals when the API recovers.

Also adds a 10-second context timeout on bootstrap API calls and applies
the same transient error handling to the TLS adherence policy fetch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

Follow-up to feast-dev#6567. Fixes two issues in the TLS profile integration:

1. Else-only pattern: NewTLSConfigFromProfile was only called in the
   success branch of the TLS profile fetch. On any error path
   (non-OpenShift cluster, resource not found), no TLS config was
   applied, leaving the operator running with Go's bare defaults
   (no MinVersion, no cipher restrictions). This PR moves
   NewTLSConfigFromProfile outside the if/else and explicitly falls
   back to Intermediate on all error paths.

2. No transient error handling: The error switch only handled
   IsNotFound and IsNoMatchError. Transient API errors
   (ServiceUnavailable, Timeout, ServerTimeout, TooManyRequests,
   context.DeadlineExceeded) hit the default case and crashed the
   operator with os.Exit(1). This PR adds a dedicated case for these
   errors with a graceful Intermediate fallback. tlsProfileFetched is
   set to true so the SecurityProfileWatcher self-heals when the API
   recovers.

Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

Follow-up to feast-dev#6567. Fixes two issues in the TLS profile integration:

1. Else-only pattern: NewTLSConfigFromProfile was only called in the
   success branch of the TLS profile fetch. On any error path
   (non-OpenShift cluster, resource not found), no TLS config was
   applied, leaving the operator running with Go's bare defaults
   (no MinVersion, no cipher restrictions). This PR moves
   NewTLSConfigFromProfile outside the if/else and explicitly falls
   back to Intermediate on all error paths.

2. No transient error handling: The error switch only handled
   IsNotFound and IsNoMatchError. Transient API errors
   (ServiceUnavailable, Timeout, ServerTimeout, TooManyRequests,
   context.DeadlineExceeded) hit the default case and crashed the
   operator with os.Exit(1). This PR adds a dedicated case for these
   errors with a graceful Intermediate fallback. tlsProfileFetched is
   set to true so the SecurityProfileWatcher self-heals when the API
   recovers.

Signed-off-by: Ugo Giordano <ugiordan@redhat.com>