This is an automated email from the ASF dual-hosted git repository. squakez pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-k.git
commit eac9b2b28518df4b24258bd6bb4acdb49790d013 Author: Keerthan <[email protected]> AuthorDate: Wed Sep 16 20:35:47 2026 +0530 refactor: refactored according to the advices, received made seperation of concerns clear among configure and apply --- pkg/trait/ingress.go | 38 +++++++++++++++++++++++--------------- pkg/trait/ingress_test.go | 12 ++++++++++-- 2 files changed, 33 insertions(+), 17 deletions(-) diff --git a/pkg/trait/ingress.go b/pkg/trait/ingress.go index 5ef9247dd..b06efeec3 100644 --- a/pkg/trait/ingress.go +++ b/pkg/trait/ingress.go @@ -40,6 +40,9 @@ const ( type ingressTrait struct { BaseTrait traitv1.IngressTrait `property:",squash"` + + certManagerAnnotationKey string + certManagerIssuerName string } func newIngressTrait() Trait { @@ -80,6 +83,16 @@ func (t *ingressTrait) Configure(e *Environment) (bool, *TraitCondition, error) } } + if t.TLSSecretName == "" && (len(t.TLSHosts) > 0 || t.Host != "") && + (t.TLSIssuerName != "" || ptr.Deref(t.TLSCertManagerAuto, false)) { + annotationKey, issuerName, err := t.resolveCertManagerIssuer(e) + if err != nil { + return false, nil, err + } + t.certManagerAnnotationKey = annotationKey + t.certManagerIssuerName = issuerName + } + //nolint:staticcheck if t.Path != "" { m := "The path parameter is deprecated and may be removed in a future release. Use the paths parameter instead." @@ -128,27 +141,22 @@ func (t *ingressTrait) Apply(e *Environment) error { tlsHosts := t.TLSHosts secretName := t.TLSSecretName - // The cert-manager path only activates when the user has not manually provided a - // secret name. It may fall back to t.Host so that auto-discovery also works for the - // common single-host case, without changing the pre-existing manual TLS behavior - // (which requires TLSHosts to be set explicitly and never considers t.Host). + // The cert-manager annotation/issuer, if any, was already resolved in Configure(). + // This only consumes that decision; it never talks to the cluster itself. It may + // fall back to t.Host so that auto-discovery also works for the common single-host + // case, without changing the pre-existing manual TLS behavior (which requires + // TLSHosts to be set explicitly and never considers t.Host). if secretName == "" { if len(tlsHosts) == 0 && t.Host != "" { tlsHosts = []string{t.Host} } - if len(tlsHosts) > 0 { - annotationKey, issuerName, err := t.resolveCertManagerIssuer(e) - if err != nil { - return err - } - if issuerName != "" { - if ingress.Annotations == nil { - ingress.Annotations = map[string]string{} - } - ingress.Annotations[annotationKey] = issuerName - secretName = service.Name + "-tls" + if len(tlsHosts) > 0 && t.certManagerIssuerName != "" { + if ingress.Annotations == nil { + ingress.Annotations = map[string]string{} } + ingress.Annotations[t.certManagerAnnotationKey] = t.certManagerIssuerName + secretName = service.Name + "-tls" } } diff --git a/pkg/trait/ingress_test.go b/pkg/trait/ingress_test.go index 56731b2c2..e7477567c 100644 --- a/pkg/trait/ingress_test.go +++ b/pkg/trait/ingress_test.go @@ -347,6 +347,8 @@ func TestApplyIngressTraitCertManagerAutoNotInstalledDoesNoop(t *testing.T) { require.NoError(t, err) environment.Client = fakeClient + _, _, err = ingressTrait.Configure(environment) + require.NoError(t, err) err = ingressTrait.Apply(environment) require.NoError(t, err) @@ -368,6 +370,8 @@ func TestApplyIngressTraitCertManagerAutoNoIssuerDoesNoop(t *testing.T) { fakeClient.(*internal.FakeClient).EnableCertManagerDiscovery() environment.Client = fakeClient + _, _, err = ingressTrait.Configure(environment) + require.NoError(t, err) err = ingressTrait.Apply(environment) require.NoError(t, err) @@ -390,6 +394,8 @@ func TestApplyIngressTraitCertManagerAutoClusterIssuerFoundDoesSucceed(t *testin fakeClient.(*internal.FakeClient).EnableCertManagerDiscovery() environment.Client = fakeClient + _, _, err = ingressTrait.Configure(environment) + require.NoError(t, err) err = ingressTrait.Apply(environment) require.NoError(t, err) @@ -416,6 +422,8 @@ func TestApplyIngressTraitForcedIssuerExistsDoesSucceed(t *testing.T) { fakeClient.(*internal.FakeClient).EnableCertManagerDiscovery() environment.Client = fakeClient + _, _, err = ingressTrait.Configure(environment) + require.NoError(t, err) err = ingressTrait.Apply(environment) require.NoError(t, err) @@ -438,7 +446,7 @@ func TestApplyIngressTraitForcedIssuerMissingDoesNotSucceed(t *testing.T) { fakeClient.(*internal.FakeClient).EnableCertManagerDiscovery() environment.Client = fakeClient - err = ingressTrait.Apply(environment) + _, _, err = ingressTrait.Configure(environment) require.Error(t, err) assert.Contains(t, err.Error(), "missing-issuer") @@ -454,7 +462,7 @@ func TestApplyIngressTraitForcedIssuerCertManagerNotInstalledDoesNotSucceed(t *t require.NoError(t, err) environment.Client = fakeClient - err = ingressTrait.Apply(environment) + _, _, err = ingressTrait.Configure(environment) require.Error(t, err) assert.Contains(t, err.Error(), "cert-manager is not installed")
