@@ -554,29 +554,65 @@ func (r *GaleraReconciler) Reconcile(ctx context.Context, req ctrl.Request) (res
554554 }
555555 instance .Status .Conditions .MarkTrue (condition .InputReadyCondition , condition .InputReadyMessage )
556556
557- var certHash , caHash string
558- specTLS := & instance .Spec .TLS
559- if err == nil && specTLS .Enabled () {
560- certHash , _ , err = specTLS .GenericService .ValidateCertSecret (ctx , helper , instance .Namespace )
561- inputHashEnv ["Cert" ] = env .SetValue (certHash )
562- }
563- if err == nil && specTLS .Ca .CaBundleSecretName != "" {
564- caName := types.NamespacedName {
565- Name : specTLS .Ca .CaBundleSecretName ,
566- Namespace : instance .Namespace ,
557+ //
558+ // TLS input validation
559+ //
560+ // Validate the CA cert secret if provided
561+ if instance .Spec .TLS .CaBundleSecretName != "" {
562+ hash , err := tls .ValidateCACertSecret (
563+ ctx ,
564+ helper .GetClient (),
565+ types.NamespacedName {
566+ Name : instance .Spec .TLS .CaBundleSecretName ,
567+ Namespace : instance .Namespace ,
568+ },
569+ )
570+ if err != nil {
571+ if k8s_errors .IsNotFound (err ) {
572+ instance .Status .Conditions .Set (condition .FalseCondition (
573+ condition .TLSInputReadyCondition ,
574+ condition .RequestedReason ,
575+ condition .SeverityInfo ,
576+ fmt .Sprintf (condition .TLSInputReadyWaitingMessage , instance .Spec .TLS .CaBundleSecretName )))
577+ return ctrl.Result {}, nil
578+ }
579+ instance .Status .Conditions .Set (condition .FalseCondition (
580+ condition .TLSInputReadyCondition ,
581+ condition .ErrorReason ,
582+ condition .SeverityWarning ,
583+ condition .TLSInputErrorMessage ,
584+ err .Error ()))
585+ return ctrl.Result {}, err
586+ }
587+
588+ if hash != "" {
589+ inputHashEnv ["CA" ] = env .SetValue (hash )
567590 }
568- caHash , _ , err = tls .ValidateCACertSecret (ctx , helper .GetClient (), caName )
569- inputHashEnv ["CA" ] = env .SetValue (caHash )
570591 }
571- if err != nil {
572- instance .Status .Conditions .Set (condition .FalseCondition (
573- condition .TLSInputReadyCondition ,
574- condition .ErrorReason ,
575- condition .SeverityWarning ,
576- condition .TLSInputErrorMessage ,
577- err .Error ()))
578- return ctrl.Result {}, fmt .Errorf ("error calculating input hash: %w" , err )
592+
593+ // Validate service cert secret
594+ if instance .Spec .TLS .Enabled () {
595+ hash , err := instance .Spec .TLS .ValidateCertSecret (ctx , helper , instance .Namespace )
596+ if err != nil {
597+ if k8s_errors .IsNotFound (err ) {
598+ instance .Status .Conditions .Set (condition .FalseCondition (
599+ condition .TLSInputReadyCondition ,
600+ condition .RequestedReason ,
601+ condition .SeverityInfo ,
602+ fmt .Sprintf (condition .TLSInputReadyWaitingMessage , err .Error ())))
603+ return ctrl.Result {}, nil
604+ }
605+ instance .Status .Conditions .Set (condition .FalseCondition (
606+ condition .TLSInputReadyCondition ,
607+ condition .ErrorReason ,
608+ condition .SeverityWarning ,
609+ condition .TLSInputErrorMessage ,
610+ err .Error ()))
611+ return ctrl.Result {}, err
612+ }
613+ inputHashEnv ["Cert" ] = env .SetValue (hash )
579614 }
615+ // all cert input checks out so report InputReady
580616 instance .Status .Conditions .MarkTrue (condition .TLSInputReadyCondition , condition .InputReadyMessage )
581617
582618 // Generate and hash config maps
@@ -594,7 +630,7 @@ func (r *GaleraReconciler) Reconcile(ctx context.Context, req ctrl.Request) (res
594630
595631 // build state of the restart hash. this is used to decide whether the
596632 // statefulset must stop all its pods before applying a config update
597- clusterPropertiesEnv ["GCommTLS" ] = env .SetValue (strconv .FormatBool (specTLS . Enabled () && specTLS .Ca .CaBundleSecretName != "" ))
633+ clusterPropertiesEnv ["GCommTLS" ] = env .SetValue (strconv .FormatBool (instance . Spec . TLS . Enabled () && instance . Spec . TLS .Ca .CaBundleSecretName != "" ))
598634 clusterPropertiesHash , err := util .HashOfInputHashes (clusterPropertiesEnv )
599635 if err != nil {
600636 return ctrl.Result {}, err
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments