fix: make mTLS client cert loading optional when permission denied

When loading proxy client certificates from env vars, log a warning
instead of failing if the files cannot be read (e.g., due to permission
denied from k8s-lare cert permissions). This allows the controller to
continue with just CA cert verification if mTLS client auth is not
strictly required by the proxy.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: dseth-linkedin

controllers/actions.github.com/secretresolver/secret_resolver.go

@@ -513,6 +513,7 @@ func (sr *SecretResolver) addProxyCACertsToPool(ctx context.Context, namespace s
 
 // loadProxyTLSClientCertsFromEnv loads TLS client certificates from file paths specified in env vars.
 // Used when proxy is set via HTTPS_PROXY env var instead of CR config.
+// If files cannot be read (e.g., permission denied), logs a warning and continues without mTLS client cert.
 func (sr *SecretResolver) loadProxyTLSClientCertsFromEnv() ([]tls.Certificate, error) {
 	var certs []tls.Certificate
 
@@ -521,7 +522,10 @@ func (sr *SecretResolver) loadProxyTLSClientCertsFromEnv() ([]tls.Certificate, e
 	if certFile != "" && keyFile != "" {
 		cert, err := tls.LoadX509KeyPair(certFile, keyFile)
 		if err != nil {
-			return nil, fmt.Errorf("failed to load client cert from files (cert=%s, key=%s): %w", certFile, keyFile, err)
+			// Log warning but don't fail - mTLS client cert may be optional for some proxies
+			sr.logger.Warn("Could not load proxy client cert from env var file paths, continuing without mTLS client cert",
+				"cert", certFile, "key", keyFile, "error", err)
+			return certs, nil
 		}
 		certs = append(certs, cert)
 		sr.logger.Info("Loaded proxy client cert from env var file paths", "cert", certFile, "key", keyFile)