CNF-26103: Add default case in istiocsr getIssuer to prevent nil-pointer

[sebrandon1]

Summary

• Adds a default case to the getIssuer switch statement that returns a descriptive error instead of leaving object as nil
• Without this, an unsupported issuer kind would cause a nil-pointer panic on the r.Get() call
• Currently guarded by assertIssuerRefExists validating the kind first, but the function itself was unsafe for direct callers

Test plan

• Existing unit tests pass (go test ./pkg/controller/istiocsr/... -count=1 — 117 passed)
• make lint clean
• CI

Summary by CodeRabbit

• Bug Fixes
  • Unsupported issuer kinds are now properly rejected with a clear error message.
  • Issuer configuration is validated to ensure only supported issuer kinds are accepted.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-26103 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds a default case to the getIssuer switch statement that returns a descriptive error instead of leaving object as nil
• Without this, an unsupported issuer kind would cause a nil-pointer panic on the r.Get() call
• Currently guarded by assertIssuerRefExists validating the kind first, but the function itself was unsafe for direct callers

Test plan

• Existing unit tests pass (go test ./pkg/controller/istiocsr/... -count=1 — 117 passed)
• make lint clean
• CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e8f80096-5900-4ca6-9d76-9c5f18bc22d3

📥 Commits

Reviewing files that changed from the base of the PR and between 864c7cf and 23b282d.

📒 Files selected for processing (1)

• pkg/controller/istiocsr/deployments.go

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/controller/istiocsr/deployments.go

---

Walkthrough

Reconciler.getIssuer now rejects unsupported issuerRefKind values with an explicit error instead of continuing with an unset issuer object.

Changes

Issuer kind validation

Layer / File(s)	Summary
Reject unsupported issuer kinds pkg/controller/istiocsr/deployments.go	Adds a default switch branch that returns an error for unsupported issuer reference kinds.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: trilokgeer, bharath-b-rh

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding a default case in istiocsr getIssuer to avoid nil-pointer panics.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No test files or Ginkgo titles were changed; the PR only adds an error branch in deployments.go.
Test Structure And Quality	✅ Passed	PASS: The PR only changes deployments.go; no Ginkgo test code was added or modified, so the test-quality checklist is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo/e2e tests were added or modified; the PR only changes pkg/controller/istiocsr/deployments.go, so MicroShift test compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only pkg/controller/istiocsr/deployments.go changed; no Ginkgo e2e tests were added or modified, so the SNO check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The only change is a getIssuer default error path in deployments.go; no replicas, affinity, nodeSelector, tolerations, or topology logic changed.
Ote Binary Stdout Contract	✅ Passed	PASS: The diff only adds an error return in getIssuer; no process-level stdout writes were introduced, and package init only registers schemes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the only change is a controller helper in deployments.go, so IPv4/disconnected checks don’t apply.
No-Weak-Crypto	✅ Passed	Touched code only adds an unsupported-kind error in issuer lookup; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or token-secret compares found.
Container-Privileges	✅ Passed	PASS: The patch only changes a Go switch in getIssuer; no container/K8s manifests or privilege fields (privileged, hostPID, allowPrivilegeEscalation, etc.) were added.
No-Sensitive-Data-In-Logs	✅ Passed	The patch only adds a default error in getIssuer; it introduces no new log statements or sensitive fields in logs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign trilokgeer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

🧹 Nitpick comments (1)

pkg/controller/istiocsr/deployments.go (1)

499-500: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a focused test for the new default branch.

The existing invalid-kind reconciliation test fails earlier in assertIssuerRefExists (lines 238-240), so it does not execute getIssuer’s new error path. Add a direct getIssuer test asserting the returned error and nil object.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/istiocsr/deployments.go` around lines 499 - 500, Add a focused
unit test for getIssuer that supplies an unsupported issuerRefKind and verifies
it returns a nil issuer object plus the expected “unsupported issuer kind”
error, bypassing assertIssuerRefExists so the default branch is exercised
directly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/controller/istiocsr/deployments.go`:
- Around line 499-500: Add a focused unit test for getIssuer that supplies an
unsupported issuerRefKind and verifies it returns a nil issuer object plus the
expected “unsupported issuer kind” error, bypassing assertIssuerRefExists so the
default branch is exercised directly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 707c2ef0-8710-4873-b407-40bd0a74bd2b

📥 Commits

Reviewing files that changed from the base of the PR and between 849995e and 864c7cf.

📒 Files selected for processing (1)

• pkg/controller/istiocsr/deployments.go

[openshift-ci]

@sebrandon1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator-tech-preview	23b282d	link	false	/test e2e-operator-tech-preview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.