CNF-26103: Add default case in istiocsr getIssuer to prevent nil-pointer

[sebrandon1]

Summary

• Adds a default case to the getIssuer switch statement that returns a descriptive error instead of leaving object as nil
• Without this, an unsupported issuer kind would cause a nil-pointer panic on the r.Get() call
• Currently guarded by assertIssuerRefExists validating the kind first, but the function itself was unsafe for direct callers
• Discovered during full-codebase unit test audit (PR #461)

Related PRs

PR	Title	Status
#461	CNF-26153: Add unit tests across codebase to close coverage gaps	Open
#462	CNF-26102: Fix istiocsr updateCondition error aggregation bug	Open
#464	CNF-26150: Fix flaky e2e ConditionMatcher.Matches early-return	Open

Jira

• CNF-26103 -- Add default case in istiocsr getIssuer to prevent nil-pointer dereference (To Do)
• Epic: CNF-23509 -- cert-manager-operator Tuning (In Progress)

Test Plan

• Existing unit tests pass (go test ./pkg/controller/istiocsr/... -count=1 -- 117 passed)
• make lint clean
• CI passes

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-26103 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds a default case to the getIssuer switch statement that returns a descriptive error instead of leaving object as nil
• Without this, an unsupported issuer kind would cause a nil-pointer panic on the r.Get() call
• Currently guarded by assertIssuerRefExists validating the kind first, but the function itself was unsafe for direct callers

Test plan

• Existing unit tests pass (go test ./pkg/controller/istiocsr/... -count=1 — 117 passed)
• make lint clean
• CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Reconciler.getIssuer now returns an error for unsupported issuerRefKind values. Tests cover supported and unsupported issuer kinds.

Changes

Issuer kind validation

Layer / File(s)	Summary
Validate issuer kinds and test lookup results pkg/controller/istiocsr/deployments.go, pkg/controller/istiocsr/deployments_test.go	The issuer lookup rejects unsupported kinds. Tests verify errors for unsupported kinds and successful lookup for Issuer and ClusterIssuer.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: trilokgeer, bharath-b-rh

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The added tests use static names: TestGetIssuerUnsupportedKind, TestGetIssuerValidKinds, and fixed subtest names; no Ginkgo titles or dynamic values appear.
Test Structure And Quality	✅ Passed	The added tests are isolated standard Go unit tests, not Ginkgo tests; they use an in-memory fake client, perform no waits or resource creation, and include diagnostic failure messages.
Microshift Test Compatibility	✅ Passed	The PR adds standard Go unit tests (TestGetIssuer...) only; it adds no Ginkgo e2e tests, unavailable MicroShift APIs, namespaces, or assumptions.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds only standard Go unit tests with t.Run; it adds no Ginkgo e2e tests or multi-node/SNO topology assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only adds an unsupported-kind error in getIssuer and unit tests; it adds no replicas, affinity, topology spread, node targeting, tolerations, or disruption constraints.
Ote Binary Stdout Contract	✅ Passed	The PR adds only an error return and ordinary Test functions; it adds no stdout/logging writes and changes no main, init, or suite setup code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The added tests are standard Go unit tests using testing.T and a fake client; they add no Ginkgo e2e cases, IPv4 assumptions, or external connectivity.
No-Weak-Crypto	✅ Passed	The PR adds only an issuer-kind error branch and unit tests. The complete PR diff contains no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The full PR diff changes only getIssuer code and tests; it adds no privileged fields, host namespaces, SYS_ADMIN, or allowPrivilegeEscalation: true.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no logging; its error only reports the configured issuer kind and fixed allowed kinds, which are not passwords, tokens, keys, PII, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding a default case in istiocsr getIssuer to prevent nil-pointer failures.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign trilokgeer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

🧹 Nitpick comments (1)

pkg/controller/istiocsr/deployments.go (1)

499-500: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a focused test for the new default branch.

The existing invalid-kind reconciliation test fails earlier in assertIssuerRefExists (lines 238-240), so it does not execute getIssuer’s new error path. Add a direct getIssuer test asserting the returned error and nil object.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/istiocsr/deployments.go` around lines 499 - 500, Add a focused
unit test for getIssuer that supplies an unsupported issuerRefKind and verifies
it returns a nil issuer object plus the expected “unsupported issuer kind”
error, bypassing assertIssuerRefExists so the default branch is exercised
directly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/controller/istiocsr/deployments.go`:
- Around line 499-500: Add a focused unit test for getIssuer that supplies an
unsupported issuerRefKind and verifies it returns a nil issuer object plus the
expected “unsupported issuer kind” error, bypassing assertIssuerRefExists so the
default branch is exercised directly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 707c2ef0-8710-4873-b407-40bd0a74bd2b

📥 Commits

Reviewing files that changed from the base of the PR and between 849995e and 864c7cf.

📒 Files selected for processing (1)

• pkg/controller/istiocsr/deployments.go

[coderabbitai]

🧹 Nitpick comments (1)

pkg/controller/istiocsr/deployments_test.go (1)

1341-1369: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Assert the concrete object type for each supported kind.

The test only checks that obj is non-nil. It would pass if both Issuer and ClusterIssuer returned the same object type. Add an expected type to each table entry and assert it after getIssuer.

Proposed test adjustment

 	tests := []struct {
-		name string
-		kind string
+		name         string
+		kind         string
+		expectedType client.Object
 	}{
-		{name: "issuer kind", kind: "Issuer"},
-		{name: "cluster issuer kind", kind: "ClusterIssuer"},
+		{name: "issuer kind", kind: "Issuer", expectedType: &certmanagerv1.Issuer{}},
+		{name: "cluster issuer kind", kind: "ClusterIssuer", expectedType: &certmanagerv1.ClusterIssuer{}},
 	}

Then compare reflect.TypeOf(obj) with reflect.TypeOf(tt.expectedType).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/istiocsr/deployments_test.go` around lines 1341 - 1369, Update
TestGetIssuerValidKinds by adding an expected concrete object type to each test
case, using the Issuer type for “Issuer” and ClusterIssuer for “ClusterIssuer”.
After getIssuer returns, compare the returned object’s type with the table
entry’s expected type via reflect.TypeOf, replacing the insufficient nil-only
assertion while preserving the existing error checks.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/controller/istiocsr/deployments_test.go`:
- Around line 1341-1369: Update TestGetIssuerValidKinds by adding an expected
concrete object type to each test case, using the Issuer type for “Issuer” and
ClusterIssuer for “ClusterIssuer”. After getIssuer returns, compare the returned
object’s type with the table entry’s expected type via reflect.TypeOf, replacing
the insufficient nil-only assertion while preserving the existing error checks.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b489cd24-d8c1-427d-b2b2-28237bc71eae

📥 Commits

Reviewing files that changed from the base of the PR and between 5a40540 and 5c1fc74.

📒 Files selected for processing (1)

• pkg/controller/istiocsr/deployments_test.go

[sebrandon1]

/retest

[openshift-ci]

@sebrandon1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator	c45bf2d	link	true	/test e2e-operator

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.