Bug: negative RequeueAfter causes infinite reconcile loop after controller restart

[Priyanshubhartistm]

📜 Description

At the end of ReconcileVpnKeyRotation, the code computes how long until the certificate expires and uses that as the requeue delay:

remainingDuration := expiryTime.Sub(metav1.Now().Time)
return ctrl.Result{RequeueAfter: remainingDuration}, nil

If the certificate is already past expiry when this line runs, remainingDuration is negative. controller-runtime treats a negative RequeueAfter as zero, so the reconciler immediately requeues itself - forever, with no delay.

👟 Reproduction steps

1. Let a VPN cert rotation get into a state where the certificate is expired
2. Restart the controller pod (this resets the in-memory jobCreationInProgress flag to false)
3. On the next reconcile, if the code reaches the final return with an expired cert, the loop begins

👍 Expected behavior

If the cert is already expired, the reconciler should requeue once (with Requeue: true) to trigger rotation, not loop endlessly.

👎 Actual Behavior

The controller enters a tight infinite loop - CPU shoots up, the API server gets hammered with requests, and other reconciliations get starved.

🐚 Relevant log output

Version

No response

🖥️ What operating system are you seeing the problem on?

No response

✅ Proposed Solution

No response

👀 Have you spent some time to check if this issue has been raised before?

• I checked and didn't find any similar issue

Code of Conduct

• I agree to follow this project's Code of Conduct

[Priyanshubhartistm]

I'm already working on this issue.