@@ -81,17 +81,22 @@ func validateBackendTLSPolicy(
8181
8282 caCertRefs := backendTLSPolicy .Spec .Validation .CACertificateRefs
8383 wellKnownCerts := backendTLSPolicy .Spec .Validation .WellKnownCACertificates
84+
85+ // Check mutual exclusivity
8486 switch {
8587 case len (caCertRefs ) > 0 && wellKnownCerts != nil :
8688 valid = false
8789 msg := "CACertificateRefs and WellKnownCACertificates are mutually exclusive"
8890 conds = append (conds , conditions .NewPolicyInvalid (msg ))
8991
9092 case len (caCertRefs ) > 0 :
91- if err := validateBackendTLSCACertRef (backendTLSPolicy , configMapResolver , secretResolver ); err != nil {
93+ certConds := validateBackendTLSCACertRef (backendTLSPolicy , configMapResolver , secretResolver )
94+ if len (certConds ) > 0 {
9295 valid = false
93- conds = append (conds , conditions .NewPolicyInvalid (
94- fmt .Sprintf ("invalid CACertificateRef: %s" , err .Error ())))
96+ conds = append (conds , certConds ... )
97+ } else if valid {
98+ // Only set ResolvedRefs to true if CACertificateRefs are valid AND overall policy is valid
99+ conds = append (conds , conditions .NewBackendTLSPolicyResolvedRefs ())
95100 }
96101
97102 case wellKnownCerts != nil :
@@ -103,8 +108,12 @@ func validateBackendTLSPolicy(
103108
104109 default :
105110 valid = false
106- conds = append (conds , conditions .NewPolicyInvalid ("CACertRefs and WellKnownCACerts are both nil" ))
111+ conds = append (
112+ conds ,
113+ conditions .NewPolicyInvalid ("either CACertificateRefs or WellKnownCACertificates must be specified" ),
114+ )
107115 }
116+
108117 return valid , ignored , conds
109118}
110119
@@ -123,11 +132,11 @@ func validateBackendTLSCACertRef(
123132 btp * v1alpha3.BackendTLSPolicy ,
124133 configMapResolver * configMapResolver ,
125134 secretResolver * secretResolver ,
126- ) error {
135+ ) []conditions. Condition {
127136 if len (btp .Spec .Validation .CACertificateRefs ) != 1 {
128137 path := field .NewPath ("validation.caCertificateRefs" )
129138 valErr := field .TooMany (path , len (btp .Spec .Validation .CACertificateRefs ), 1 )
130- return valErr
139+ return []conditions. Condition { conditions . NewPolicyInvalid ( valErr . Error ())}
131140 }
132141
133142 selectedCertRef := btp .Spec .Validation .CACertificateRefs [0 ]
@@ -136,13 +145,19 @@ func validateBackendTLSCACertRef(
136145 if ! slices .Contains (allowedCaCertKinds , selectedCertRef .Kind ) {
137146 path := field .NewPath ("validation.caCertificateRefs[0].kind" )
138147 valErr := field .NotSupported (path , btp .Spec .Validation .CACertificateRefs [0 ].Kind , allowedCaCertKinds )
139- return valErr
148+ return []conditions.Condition {
149+ conditions .NewBackendTLSPolicyInvalidKind (valErr .Error ()),
150+ conditions .NewBackendTLSPolicyNoValidCACertificate ("No valid CACertificateRef found" ),
151+ }
140152 }
141153 if selectedCertRef .Group != "" &&
142154 selectedCertRef .Group != "core" {
143155 path := field .NewPath ("validation.caCertificateRefs[0].group" )
144156 valErr := field .NotSupported (path , selectedCertRef .Group , []string {"" , "core" })
145- return valErr
157+ return []conditions.Condition {
158+ conditions .NewBackendTLSPolicyInvalidKind (valErr .Error ()),
159+ conditions .NewBackendTLSPolicyNoValidCACertificate ("No valid CACertificateRef found" ),
160+ }
146161 }
147162 nsName := types.NamespacedName {
148163 Namespace : btp .Namespace ,
@@ -153,15 +168,21 @@ func validateBackendTLSCACertRef(
153168 case "ConfigMap" :
154169 if err := configMapResolver .resolve (nsName ); err != nil {
155170 path := field .NewPath ("validation.caCertificateRefs[0]" )
156- return field .Invalid (path , selectedCertRef , err .Error ())
171+ valErr := field .Invalid (path , selectedCertRef , err .Error ())
172+ return []conditions.Condition {
173+ conditions .NewBackendTLSPolicyInvalidCACertificateRef (valErr .Error ()),
174+ conditions .NewBackendTLSPolicyNoValidCACertificate ("No valid CACertificateRef found" ),
175+ }
157176 }
158177 case "Secret" :
159178 if err := secretResolver .resolve (nsName ); err != nil {
160179 path := field .NewPath ("validation.caCertificateRefs[0]" )
161- return field .Invalid (path , selectedCertRef , err .Error ())
180+ valErr := field .Invalid (path , selectedCertRef , err .Error ())
181+ return []conditions.Condition {
182+ conditions .NewBackendTLSPolicyInvalidCACertificateRef (valErr .Error ()),
183+ conditions .NewBackendTLSPolicyNoValidCACertificate ("No valid CACertificateRef found" ),
184+ }
162185 }
163- default :
164- return fmt .Errorf ("invalid certificate reference kind %q" , selectedCertRef .Kind )
165186 }
166187 return nil
167188}
0 commit comments