Skip to content

rotator: ignore CRDs without conversion webhook client config#492

Open
sozercan wants to merge 1 commit intomasterfrom
codex/propose-fix-for-crd-conversion-webhook-error
Open

rotator: ignore CRDs without conversion webhook client config#492
sozercan wants to merge 1 commit intomasterfrom
codex/propose-fix-for-crd-conversion-webhook-error

Conversation

@sozercan
Copy link
Copy Markdown
Member

@sozercan sozercan commented Apr 9, 2026

Motivation

  • CRD conversion webhooks are optional, and treating a missing spec.conversion.webhook.clientConfig as an error caused reconciler readiness to fail and could prevent the controller from starting.

Description

  • Change injectCertToConversionWebhook to return nil (no-op) when the conversion clientConfig is absent instead of returning an error; this prevents optional CRDs from aborting CA injection. (modified pkg/rotator/rotator.go).
  • Add a focused unit test TestInjectCertToConversionWebhookWithoutClientConfig that verifies injecting a cert is a no-op when the conversion webhook clientConfig is missing and that no caBundle is created. (added to pkg/rotator/rotator_test.go).

Testing

  • Ran gofmt -w pkg/rotator/rotator.go pkg/rotator/rotator_test.go successfully to format changes.
  • Attempted to run the focused unit test with go test ./pkg/rotator -run TestInjectCertToConversionWebhookWithoutClientConfig -count=1, but the command timed out in this environment (exit code 124); the test was added and compiles locally in the change set.

Codex Task

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR prevents CA injection from failing when a CRD does not define a conversion webhook clientConfig (a valid/optional configuration), ensuring the rotator/reconciler can still become ready and proceed with other resources.

Changes:

  • Make injectCertToConversionWebhook a no-op (return nil) when spec.conversion.webhook.clientConfig is absent.
  • Add a unit test to verify no-op behavior and that caBundle is not created when clientConfig is missing.
Show a summary per file
File Description
pkg/rotator/rotator.go Treat missing conversion webhook clientConfig as non-fatal by returning nil (skip injection).
pkg/rotator/rotator_test.go Adds a focused unit test asserting CA injection does not create caBundle when conversion webhook clientConfig is absent.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 0

Copy link
Copy Markdown
Contributor

@JaydipGabani JaydipGabani left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not confident in changing this behavior, if someone complains then we can change it, but until then this should not be changed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants