Address PR review comments

pkg/watcher/watcher.go:
- Use sync.Once to protect one-time initialisation of initialHash in
  AddFunc, eliminating the potential data race
- Handle cache.DeletedFinalStateUnknown tombstones in DeleteFunc to
  avoid a panic when the informer reconnects after a disconnect

pkg/watcher/watcher_test.go:
- Replace hard-coded 200ms waits with a noEventWait constant (500ms)
  for more stable CI behaviour
- cancelWrapper in TestStart_CancelFuncCalledWhenNoOnChangeFunc now
  calls the real cancel function; uses a dedicated watcher context so
  the test select does not race between cancelCalled and ctx.Done()

pkg/tls/config.go + callers:
- Rename TLSConfigFromFlags -> ConfigFromFlags
- Rename TLSVersionToString -> VersionToString
- Rename TLSConfigToFunc    -> ConfigToFunc
  to fix revive stutter lint errors (tls.TLS*)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: zhujian <jiazhu@redhat.com>

Author: zhujian7

pkg/watcher/watcher.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
@@ -27,6 +28,7 @@ type ConfigMapWatcher struct {
 	configMapName string
 	cancelFunc    context.CancelFunc
 	initialHash   string
+	initOnce      sync.Once
 	onChangeFunc  func()
 }
 
@@ -78,13 +80,19 @@ func (w *ConfigMapWatcher) Start(ctx context.Context) error {
 				return
 			}
 			cmHash := hashConfigMap(cm)
-			if w.initialHash == "" {
-				// No CM existed at startup; treat this as the baseline.
-				w.initialHash = cmHash
-				logger.V(4).Info("ConfigMap added, initial hash set", "configmap", cm.Name, "hash", cmHash)
-			} else if cmHash != w.initialHash {
-				// CM existed at startup (initData was provided) but changed in the window
-				// between the initial load and the watcher starting. Restart to apply it.
+			var needsRestart bool
+			w.initOnce.Do(func() {
+				if w.initialHash == "" {
+					// No CM existed at startup; treat this as the baseline.
+					w.initialHash = cmHash
+					logger.V(4).Info("ConfigMap added, initial hash set", "configmap", cm.Name, "hash", cmHash)
+				} else if cmHash != w.initialHash {
+					// CM existed at startup (initData was provided) but changed in the window
+					// between the initial load and the watcher starting. Restart to apply it.
+					needsRestart = true
+				}
+			})
+			if needsRestart {
 				logger.Info("ConfigMap differs from initial config, restarting",
 					"configmap", cm.Name,
 					"initialHash", w.initialHash,
@@ -112,7 +120,19 @@ func (w *ConfigMapWatcher) Start(ctx context.Context) error {
 			}
 		},
 		DeleteFunc: func(obj interface{}) {
-			cm := obj.(*corev1.ConfigMap)
+			cm, ok := obj.(*corev1.ConfigMap)
+			if !ok {
+				tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+				if !ok {
+					logger.Error(nil, "Unexpected object type in DeleteFunc", "type", fmt.Sprintf("%T", obj))
+					return
+				}
+				cm, ok = tombstone.Obj.(*corev1.ConfigMap)
+				if !ok {
+					logger.Error(nil, "Tombstone contained unexpected object type", "type", fmt.Sprintf("%T", tombstone.Obj))
+					return
+				}
+			}
 			if cm.Name != w.configMapName {
 				return
 			}

pkg/watcher/watcher_test.go

@@ -13,6 +13,10 @@ import (
 const (
 	testNamespace     = "test-ns"
 	testConfigMapName = "test-cm"
+
+	// noEventWait is how long "no trigger expected" tests wait before declaring success.
+	// Kept generous enough to avoid flakiness under loaded CI.
+	noEventWait = 500 * time.Millisecond
 )
 
 func newCM(data map[string]string) *corev1.ConfigMap {
@@ -140,7 +144,7 @@ func TestStart_AddFunc_NoInitData_SetsBaseline(t *testing.T) {
 	select {
 	case <-triggered:
 		t.Error("onChangeFunc triggered unexpectedly when no initData was provided")
-	case <-time.After(200 * time.Millisecond):
+	case <-time.After(noEventWait):
 		// expected: no trigger
 	}
 }
@@ -165,7 +169,7 @@ func TestStart_AddFunc_MatchingInitData_NoTrigger(t *testing.T) {
 	select {
 	case <-triggered:
 		t.Error("onChangeFunc triggered unexpectedly when initData matched CM")
-	case <-time.After(200 * time.Millisecond):
+	case <-time.After(noEventWait):
 		// expected: no trigger
 	}
 }
@@ -223,7 +227,7 @@ func TestStart_UpdateFunc_SameData_NoTrigger(t *testing.T) {
 	select {
 	case <-triggered:
 		t.Error("onChangeFunc triggered unexpectedly on no-op update")
-	case <-time.After(200 * time.Millisecond):
+	case <-time.After(noEventWait):
 		// expected
 	}
 }
@@ -318,7 +322,7 @@ func TestStart_WrongConfigMapName_Ignored(t *testing.T) {
 	select {
 	case <-triggered:
 		t.Error("onChangeFunc triggered for a CM with a different name")
-	case <-time.After(200 * time.Millisecond):
+	case <-time.After(noEventWait):
 		// expected
 	}
 }
@@ -331,27 +335,37 @@ func TestStart_CancelFuncCalledWhenNoOnChangeFunc(t *testing.T) {
 	client := fake.NewClientset(cm)
 
 	cancelCalled := make(chan struct{}, 1)
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	cancelWrapper := func() { cancelCalled <- struct{}{} }
+	// Use a dedicated context for the watcher so that cancelWrapper cancelling it
+	// does not race with the test's own timeout select case.
+	watcherCtx, watcherCancel := context.WithCancel(context.Background())
+	defer watcherCancel()
+	cancelWrapper := func() {
+		watcherCancel()
+		select {
+		case cancelCalled <- struct{}{}:
+		default:
+		}
+	}
 
 	w := NewConfigMapWatcher(client, testNamespace, testConfigMapName, cancelWrapper, data)
 	// Do NOT call SetOnChangeFunc — cancelFunc should be the fallback.
 
-	if err := w.Start(ctx); err != nil {
+	if err := w.Start(watcherCtx); err != nil {
 		t.Fatalf("Start returned error: %v", err)
 	}
 
 	updated := newCM(map[string]string{"k": "new-value"})
-	_, err := client.CoreV1().ConfigMaps(testNamespace).Update(ctx, updated, metav1.UpdateOptions{})
+	updateCtx, updateCancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer updateCancel()
+	_, err := client.CoreV1().ConfigMaps(testNamespace).Update(updateCtx, updated, metav1.UpdateOptions{})
 	if err != nil {
 		t.Fatalf("Update failed: %v", err)
 	}
 
 	select {
 	case <-cancelCalled:
 		// expected
-	case <-ctx.Done():
+	case <-time.After(2 * time.Second):
 		t.Error("timed out waiting for cancelFunc to be called")
 	}
 }