🤖 Intermittent data race in vendored apiserver secure serving under go test -race #233

Problem

go test -race ./internal/app/apiserverapp/ reported a data race once in TestRunWithOptionsKeepsAPIServiceCABundleInSync. The race is in vendored k8s.io/apiserver (v0.35.0):

• Write: vendor/k8s.io/apiserver/pkg/server/secure_serving.go:145 sets tlsConfig.GetConfigForClient.
• Read: the goroutine that line 143 starts (go dynamicCertificateController.Run(1, stopCh)) calls tlsConfig.Clone() in dynamiccertificates/tlsconfig.go:171.

The goroutine starts before the write, so the two accesses are not ordered. I saw it once on the branch of #232 while the host was busy. It did not repeat in 3 full-package -race runs on that branch or 3 on main (8805e14). CI does not run -race, so CI is not affected. #232 does not touch this code.

Proposal

Check whether upstream Kubernetes already fixed or tracks this ordering in SecureServingInfo.tlsConfig. If not, report it upstream. Do not patch vendor/.

Revisit when

k8s.io/apiserver is updated, or -race is added to CI.

Generated with mux • Model: anthropic:claude-opus-5-5 • Thinking: high