Treat CustomKubeletIdentityMissingPermissionError as retryable

v2/api/containerservice/customizations/managed_cluster_extensions.go

@@ -8,6 +8,7 @@ package customizations
 import (
 	"context"
 	"fmt"
+	"github.com/Azure/azure-service-operator/v2/pkg/genruntime/core"
 	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice"
@@ -181,3 +182,43 @@ func clusterProvisioningStateBlocksReconciliation(provisioningState *string) boo
 
 	return !nonBlockingManagedClusterProvisioningStates.Contains(strings.ToLower(*provisioningState))
 }
+
+var _ extensions.ErrorClassifier = &ManagedClusterExtension{}
+
+// ClassifyError evaluates the provided error, returning including whether it is fatal or can be retried.
+// cloudError is the error returned from ARM.
+// apiVersion is the ARM API version used for the request.
+// log is a logger than can be used for telemetry.
+// next is the next implementation to call.
+func (ext *ManagedClusterExtension) ClassifyError(
+	cloudError *genericarmclient.CloudError,
+	apiVersion string,
+	log logr.Logger,
+	next extensions.ErrorClassifierFunc,
+) (core.CloudErrorDetails, error) {
+	details, err := next(cloudError)
+	if err != nil {
+		return core.CloudErrorDetails{}, err
+	}
+
+	// Override is to treat Conflict as retryable for Redis, if the message contains "try again later"
+	if isRetryableClusterError(cloudError) {
+		details.Classification = core.ErrorRetryable
+	}
+
+	return details, nil
+}
+
+func isRetryableClusterError(err *genericarmclient.CloudError) bool {
+	if err == nil {
+		return false
+	}
+
+	// A CustomKubeletIdentityMissingPermissionError can occur if the user-assigned identity required by the cluster
+	// hasn't yet been provisioned; we want to retry so that we finish provisioning the cluster once it is available.
+	if err.Code() == "CustomKubeletIdentityMissingPermissionError" {
+		return true
+	}
+
+	return false
+}