Fixes#2668
When Kubernetes marks nodes as "Ready" before their Certificate Signing
Requests (CSRs) are approved, the buildx kubernetes driver can fail to
connect to builder pods with transient TLS errors like:
- "tls: internal error"
- "context deadline exceeded"
- "use of closed network connection"
- "i/o timeout"
This is particularly problematic on EKS clusters with ARM64 nodes under
heavy load, where multiple builders are being spawned simultaneously.
This commit adds retry logic with exponential backoff to the Dial()
function in the kubernetes driver. The implementation:
- Attempts up to 5 connection retries
- Uses exponential backoff starting at 500ms, capped at 10s
- Only retries on known transient connection errors
- Uses errors.Is/errors.As for proper error type checking
- Logs retry attempts using logrus for visibility
- Respects context cancellation
This allows buildx to gracefully handle the race condition where pods
are marked as Running before their TLS certificates are fully ready.
Signed-off-by: guimove <dasilva.guillaume@live.fr>
guimove
e758a6b917