From 7ac86c4b8579b71412f1dc65acae2360f8ebdefa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Serta=C3=A7=20=C3=96zercan?=
 <852750+sozercan@users.noreply.github.com>
Date: Thu, 9 Apr 2026 12:38:35 -0700
Subject: [PATCH] rotator: ignore CRDs without conversion webhook client config

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
---
 pkg/rotator/rotator.go      |  2 +-
 pkg/rotator/rotator_test.go | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/pkg/rotator/rotator.go b/pkg/rotator/rotator.go
index 74889bf..5cf6f2b 100644
--- a/pkg/rotator/rotator.go
+++ b/pkg/rotator/rotator.go
@@ -447,7 +447,7 @@ func injectCertToConversionWebhook(crd *unstructured.Unstructured, certPem []byt
 		return err
 	}
 	if !found {
-		return errors.New("`conversion.webhook.clientConfig` field not found in CustomResourceDefinition")
+		return nil
 	}
 	if err := unstructured.SetNestedField(crd.Object, base64.StdEncoding.EncodeToString(certPem), "spec", "conversion", "webhook", "clientConfig", "caBundle"); err != nil {
 		return err
diff --git a/pkg/rotator/rotator_test.go b/pkg/rotator/rotator_test.go
index 59bf17b..165540c 100644
--- a/pkg/rotator/rotator_test.go
+++ b/pkg/rotator/rotator_test.go
@@ -71,6 +71,28 @@ func TestCertSigning(t *testing.T) {
 	}
 }
 
+func TestInjectCertToConversionWebhookWithoutClientConfig(t *testing.T) {
+	crd := &unstructured.Unstructured{Object: map[string]interface{}{
+		"spec": map[string]interface{}{
+			"conversion": map[string]interface{}{
+				"strategy": "None",
+			},
+		},
+	}}
+
+	if err := injectCertToConversionWebhook(crd, []byte("dummy-cert")); err != nil {
+		t.Fatalf("injecting certificate should be a no-op when conversion webhook clientConfig is missing: %v", err)
+	}
+
+	_, found, err := unstructured.NestedString(crd.Object, "spec", "conversion", "webhook", "clientConfig", "caBundle")
+	if err != nil {
+		t.Fatalf("unexpected error checking conversion webhook caBundle: %v", err)
+	}
+	if found {
+		t.Fatal("caBundle should not be created when conversion webhook clientConfig is missing")
+	}
+}
+
 func TestCertExpiry(t *testing.T) {
 	caArtifacts, err := cr.CreateCACert(begin, end)
 	if err != nil {