diff --git a/pkg/rotator/rotator.go b/pkg/rotator/rotator.go index 74889bf..5cf6f2b 100644 --- a/pkg/rotator/rotator.go +++ b/pkg/rotator/rotator.go @@ -447,7 +447,7 @@ func injectCertToConversionWebhook(crd *unstructured.Unstructured, certPem []byt return err } if !found { - return errors.New("`conversion.webhook.clientConfig` field not found in CustomResourceDefinition") + return nil } if err := unstructured.SetNestedField(crd.Object, base64.StdEncoding.EncodeToString(certPem), "spec", "conversion", "webhook", "clientConfig", "caBundle"); err != nil { return err diff --git a/pkg/rotator/rotator_test.go b/pkg/rotator/rotator_test.go index 59bf17b..165540c 100644 --- a/pkg/rotator/rotator_test.go +++ b/pkg/rotator/rotator_test.go @@ -71,6 +71,28 @@ func TestCertSigning(t *testing.T) { } } +func TestInjectCertToConversionWebhookWithoutClientConfig(t *testing.T) { + crd := &unstructured.Unstructured{Object: map[string]interface{}{ + "spec": map[string]interface{}{ + "conversion": map[string]interface{}{ + "strategy": "None", + }, + }, + }} + + if err := injectCertToConversionWebhook(crd, []byte("dummy-cert")); err != nil { + t.Fatalf("injecting certificate should be a no-op when conversion webhook clientConfig is missing: %v", err) + } + + _, found, err := unstructured.NestedString(crd.Object, "spec", "conversion", "webhook", "clientConfig", "caBundle") + if err != nil { + t.Fatalf("unexpected error checking conversion webhook caBundle: %v", err) + } + if found { + t.Fatal("caBundle should not be created when conversion webhook clientConfig is missing") + } +} + func TestCertExpiry(t *testing.T) { caArtifacts, err := cr.CreateCACert(begin, end) if err != nil {