Fix data races in built-in BundlePublisher plugins on dynamic reconfiguration

[amartinezfayo]

The built-in BundlePublisher plugins assign their storage client in Configure and read it in PublishBundle without any synchronization. Several of them also read the cached bundle in getBundle while holding configMtx, even though setBundle writes it under a separate bundleMtx, so the two never exclude each other.

These were harmless while Configure only ran once during plugin initialization, but dynamic reconfiguration now calls Configure again at runtime, so it can run concurrently with PublishBundle. That produces data races on both the client field and the cached bundle, and a concurrent reconfiguration could also leave PublishBundle using a client that no longer matches the active configuration.

This PR fixes the aws_s3, gcp_cloudstorage, and aws_rolesanywhere_trustanchor plugins by storing the configuration and its client together and updating them atomically under configMtx, with getConfig returning both so that PublishBundle always observes a matching pair. It also corrects getBundle in those plugins to read under bundleMtx, matching setBundle. The k8s_configmap plugin already stores its clients inside the configuration and reads the bundle under the correct lock, so it needs no change. The azure_blob plugin under review in #7030 has the same structure and adopts this pattern there.

Changes:

• Store the config and storage client as a pair under configMtx in the aws_s3, gcp_cloudstorage, and aws_rolesanywhere_trustanchor plugins, returned together from getConfig.
• Read the cached bundle under bundleMtx in getBundle to match setBundle in those plugins.
• Guard the client read in the gcp_cloudstorage Close method.
• Add a TestConcurrentConfigureAndPublish regression test to each fixed plugin that runs Configure and PublishBundle concurrently and fails under -race without the fix.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Fixes data races in built-in BundlePublisher plugins during dynamic reconfiguration by ensuring configuration/client are updated and read atomically, and by using the correct mutex for cached bundle access.

Changes:

• Atomically store and retrieve (config, client) under configMtx in aws_s3, gcp_cloudstorage, and aws_rolesanywhere_trustanchor.
• Fix getBundle to read under bundleMtx (matching setBundle) in the affected plugins.
• Add concurrent Configure vs PublishBundle regression tests intended to fail under -race without the fix.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/server/plugin/bundlepublisher/gcpcloudstorage/gcpcloudstorage.go	Atomically pairs config+client under configMtx; fixes bundle locking; guards client read in Close.
pkg/server/plugin/bundlepublisher/gcpcloudstorage/gcpcloudstorage_test.go	Adds concurrent Configure/Publish regression test.
pkg/server/plugin/bundlepublisher/awss3/awss3.go	Atomically pairs config+client under configMtx; fixes bundle locking.
pkg/server/plugin/bundlepublisher/awss3/awss3_test.go	Adds concurrent Configure/Publish regression test.
pkg/server/plugin/bundlepublisher/awsrolesanywhere/awsrolesanywhere.go	Atomically pairs config+client under configMtx; fixes bundle locking; introduces setConfig.
pkg/server/plugin/bundlepublisher/awsrolesanywhere/awsrolesanywhere_test.go	Adds concurrent Configure/Publish regression test.