From c45bf2d6714ecee52f0edbbc2c0172f02650a3e3 Mon Sep 17 00:00:00 2001
From: Brandon Palm <bpalm@redhat.com>
Date: Tue, 4 Aug 2026 13:35:33 -0500
Subject: [PATCH] CNF-26103: Add default case in istiocsr getIssuer to prevent
 nil-pointer

Add a default case to the getIssuer switch that returns a descriptive
error for unsupported issuer kinds instead of falling through with a
nil object. Includes table-driven tests for all three branches (Issuer,
ClusterIssuer, unsupported kind) with type assertions on the returned
objects.
---
 pkg/controller/istiocsr/deployments.go      |  2 +
 pkg/controller/istiocsr/deployments_test.go | 48 +++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/pkg/controller/istiocsr/deployments.go b/pkg/controller/istiocsr/deployments.go
index 77b306309..8d83218cc 100644
--- a/pkg/controller/istiocsr/deployments.go
+++ b/pkg/controller/istiocsr/deployments.go
@@ -496,6 +496,8 @@ func (r *Reconciler) getIssuer(istiocsr *v1alpha1.IstioCSR) (client.Object, erro
 		object = &certmanagerv1.ClusterIssuer{}
 	case issuerKind:
 		object = &certmanagerv1.Issuer{}
+	default:
+		return nil, fmt.Errorf("unsupported issuer kind %q: must be %q or %q", issuerRefKind, clusterIssuerKind, issuerKind)
 	}
 
 	if err := r.Get(r.ctx, key, object); err != nil {
diff --git a/pkg/controller/istiocsr/deployments_test.go b/pkg/controller/istiocsr/deployments_test.go
index fad4d8162..ed2dd343e 100644
--- a/pkg/controller/istiocsr/deployments_test.go
+++ b/pkg/controller/istiocsr/deployments_test.go
@@ -1319,3 +1319,51 @@ func TestUpdateVolumeWithIssuerCA(t *testing.T) {
 		})
 	}
 }
+
+func TestGetIssuerUnsupportedKind(t *testing.T) {
+	r := testReconciler(t)
+
+	istiocsr := testIstioCSR()
+	istiocsr.Spec.IstioCSRConfig.CertManager.IssuerRef.Kind = "bogus"
+
+	obj, err := r.getIssuer(istiocsr)
+	if obj != nil {
+		t.Errorf("expected nil object for unsupported kind, got %T", obj)
+	}
+	if err == nil {
+		t.Fatal("expected error for unsupported issuer kind")
+	}
+	if !strings.Contains(err.Error(), "unsupported issuer kind") {
+		t.Errorf("unexpected error message: %v", err)
+	}
+}
+
+func TestGetIssuerValidKinds(t *testing.T) {
+	tests := []struct {
+		name string
+		kind string
+	}{
+		{name: "issuer kind", kind: "Issuer"},
+		{name: "cluster issuer kind", kind: "ClusterIssuer"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fakeClient := &fakes.FakeCtrlClient{}
+			fakeClient.GetReturns(nil)
+
+			r := testReconciler(t)
+			r.CtrlClient = fakeClient
+
+			istiocsr := testIstioCSR()
+			istiocsr.Spec.IstioCSRConfig.CertManager.IssuerRef.Kind = tt.kind
+
+			obj, err := r.getIssuer(istiocsr)
+			if err != nil {
+				t.Fatalf("unexpected error for kind %q: %v", tt.kind, err)
+			}
+			if obj == nil {
+				t.Fatalf("expected non-nil object for kind %q", tt.kind)
+			}
+		})
+	}
+}