From 23b282dbb3132f85a390d5702ed2a355bad6e708 Mon Sep 17 00:00:00 2001 From: Brandon Palm Date: Thu, 23 Jul 2026 16:45:23 -0500 Subject: [PATCH] CNF-26103: Add default case in istiocsr getIssuer to prevent nil-pointer The getIssuer switch statement only handled clusterissuer and issuer kinds, leaving the object variable nil for any other kind. Although callers currently validate the kind beforehand, a direct call to getIssuer with an unsupported kind would panic on the subsequent Get() call. Return a descriptive error instead. --- pkg/controller/istiocsr/deployments.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkg/controller/istiocsr/deployments.go b/pkg/controller/istiocsr/deployments.go index 77b306309..8d83218cc 100644 --- a/pkg/controller/istiocsr/deployments.go +++ b/pkg/controller/istiocsr/deployments.go @@ -496,6 +496,8 @@ func (r *Reconciler) getIssuer(istiocsr *v1alpha1.IstioCSR) (client.Object, erro object = &certmanagerv1.ClusterIssuer{} case issuerKind: object = &certmanagerv1.Issuer{} + default: + return nil, fmt.Errorf("unsupported issuer kind %q: must be %q or %q", issuerRefKind, clusterIssuerKind, issuerKind) } if err := r.Get(r.ctx, key, object); err != nil {