[MAR-3131] Set grace to 0 on non-positive lease duration

api/lifetime_watcher.go

@@ -377,7 +377,7 @@ func (r *LifetimeWatcher) doRenewWithOptions(tokenMode bool, nonRenewable bool,
 // assumptions given the total lease time; it also adds some jitter to not have
 // clients be in sync.
 func (r *LifetimeWatcher) calculateGrace(leaseDuration time.Duration) {
-	if leaseDuration == 0 {
+	if leaseDuration <= 0 {
 		r.grace = 0
 		return
 	}

api/renewer_test.go

@@ -149,6 +149,17 @@ func TestLifetimeWatcher(t *testing.T) {
 			nil,
 			false,
 		},
+		{
+			15 * time.Second,
+			"negative_lease_duration",
+			-15,
+			15,
+			func(_ string, _ int) (*Secret, error) {
+				return renewedSecret, nil
+			},
+			nil,
+			true,
+		},
 	}
 
 	for _, tc := range cases {

changelog/12372.txt

@@ -0,0 +1,3 @@
+```release-note: bug
+core/api: Fix an arm64 bug converting a negative int to an unsigned int
+```