Merge pull request #123 from datum-cloud/fix/certissuance

fix: move ownerRef for existing cert fixes

Author: zachsmith1

internal/controller/gateway_controller.go

@@ -514,18 +514,19 @@ func (r *GatewayReconciler) ensureListenerCertificates(
 
 		isNew := cert.CreationTimestamp.IsZero()
 		if isNew {
-			// Use the downstream strategy for anchor-based ownership tracking
-			// (labels + anchor ConfigMap) so cleanup logic can find these Certs.
 			if err := downstreamStrategy.SetControllerReference(ctx, upstreamGateway, cert); err != nil {
 				result.Err = fmt.Errorf("failed to set strategy reference on Certificate %s: %w", certName, err)
 				return result
 			}
-			// Also set the downstream Gateway as the controller owner. The
-			// downstream certificate solver controller walks the ownership
-			// chain (Challenge → Order → Certificate → Gateway) to locate
-			// the Gateway when creating solver HTTPRoutes for HTTP-01
-			// challenges. Without this, the solver skips the Certificate
-			// because it cannot resolve the anchor ConfigMap to a Gateway.
+		}
+
+		// Ensure the downstream Gateway is the controller owner. The
+		// downstream certificate solver controller walks the ownership
+		// chain (Challenge → Order → Certificate → Gateway) to locate
+		// the Gateway when creating solver HTTPRoutes for HTTP-01
+		// challenges.
+		ownerRefChanged := !metav1.IsControlledBy(cert, downstreamGateway)
+		if ownerRefChanged {
 			if err := controllerutil.SetControllerReference(downstreamGateway, cert, downstreamClient.Scheme()); err != nil {
 				result.Err = fmt.Errorf("failed to set controller reference on Certificate %s: %w", certName, err)
 				return result
@@ -552,7 +553,7 @@ func (r *GatewayReconciler) ensureListenerCertificates(
 			cert.Spec = desiredSpec
 			err = downstreamClient.Create(ctx, cert)
 			opResult = "created"
-		} else if !equality.Semantic.DeepEqual(cert.Spec, desiredSpec) {
+		} else if !equality.Semantic.DeepEqual(cert.Spec, desiredSpec) || ownerRefChanged {
 			cert.Spec = desiredSpec
 			err = downstreamClient.Update(ctx, cert)
 			opResult = "updated"