Simplify worker auth rotation timing logic (#3237)

* Simplify worker auth rotation timing logic

* Add some jitter

internal/daemon/controller/controller.go

@@ -144,6 +144,7 @@ type Controller struct {
 }
 
 func New(ctx context.Context, conf *Config) (*Controller, error) {
+	const op = "controller.New"
 	metric.InitializeApiCollectors(conf.PrometheusRegisterer)
 	c := &Controller{
 		conf:                    conf,
@@ -395,7 +396,7 @@ func New(ctx context.Context, conf *Config) (*Controller, error) {
 	}
 	_, err = server.RotateRoots(ctx, serversRepo, nodeenrollment.WithCertificateLifetime(conf.TestOverrideWorkerAuthCaCertificateLifetime))
 	if err != nil {
-		return nil, fmt.Errorf("unable to ensure worker auth roots exist: %w", err)
+		event.WriteSysEvent(ctx, op, "unable to ensure worker auth roots exist, may be due to multiple controllers starting at once, continuing")
 	}
 
 	if downstreamersFactory != nil {

internal/daemon/controller/testing.go

@@ -473,6 +473,9 @@ type TestControllerOpts struct {
 	// The amount of time between the scheduler waking up to run it's registered
 	// jobs.
 	SchedulerRunJobInterval time.Duration
+
+	// The time to use for CA certificate lifetime for worker auth
+	WorkerAuthCaCertificateLifetime time.Duration
 }
 
 func NewTestController(t testing.TB, opts *TestControllerOpts) *TestController {
@@ -774,6 +777,7 @@ func TestControllerConfig(t testing.TB, ctx context.Context, tc *TestController,
 		RawConfig:                    opts.Config,
 		Server:                       tc.b,
 		DisableAuthorizationFailures: opts.DisableAuthorizationFailures,
+		TestOverrideWorkerAuthCaCertificateLifetime: opts.WorkerAuthCaCertificateLifetime,
 	}
 }