From 3b6bd9be252687dda7e38caf6e30a6e18f110247 Mon Sep 17 00:00:00 2001
From: Clayton Coleman <ccoleman@redhat.com>
Date: Thu, 3 May 2018 21:12:43 -0400
Subject: [PATCH] Retry certificate approval on conflict errors

We already check preconditions.
---
 pkg/kubectl/cmd/certificates.go | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/pkg/kubectl/cmd/certificates.go b/pkg/kubectl/cmd/certificates.go
index d7357cba955..e1e31aee6fb 100644
--- a/pkg/kubectl/cmd/certificates.go
+++ b/pkg/kubectl/cmd/certificates.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"io"
 
+	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/kubernetes/pkg/api/legacyscheme"
@@ -216,15 +217,24 @@ func (options *CertificateOptions) modifyCertificateCondition(builder *resource.
 		if err != nil {
 			return err
 		}
-		csr := info.Object.(*certificates.CertificateSigningRequest)
-		csr, hasCondition := modify(csr)
-		if !hasCondition || force {
-			csr, err = clientSet.Certificates().
-				CertificateSigningRequests().
-				UpdateApproval(csr)
-			if err != nil {
-				return err
+		for i := 0; ; i++ {
+			csr := info.Object.(*certificates.CertificateSigningRequest)
+			csr, hasCondition := modify(csr)
+			if !hasCondition || force {
+				csr, err = clientSet.Certificates().
+					CertificateSigningRequests().
+					UpdateApproval(csr)
+				if errors.IsConflict(err) && i < 10 {
+					if err := info.Get(); err != nil {
+						return err
+					}
+					continue
+				}
+				if err != nil {
+					return err
+				}
 			}
+			break
 		}
 		found++