CNF-26103: Add default case in istiocsr getIssuer to prevent nil-pointer

pkg/controller/istiocsr/deployments.go

@@ -496,6 +496,8 @@ func (r *Reconciler) getIssuer(istiocsr *v1alpha1.IstioCSR) (client.Object, erro
 		object = &certmanagerv1.ClusterIssuer{}
 	case issuerKind:
 		object = &certmanagerv1.Issuer{}
+	default:
+		return nil, fmt.Errorf("unsupported issuer kind %q: must be %q or %q", issuerRefKind, clusterIssuerKind, issuerKind)
 	}
 
 	if err := r.Get(r.ctx, key, object); err != nil {

pkg/controller/istiocsr/deployments_test.go

@@ -1319,3 +1319,51 @@ func TestUpdateVolumeWithIssuerCA(t *testing.T) {
 		})
 	}
 }
+
+func TestGetIssuerUnsupportedKind(t *testing.T) {
+	r := testReconciler(t)
+
+	istiocsr := testIstioCSR()
+	istiocsr.Spec.IstioCSRConfig.CertManager.IssuerRef.Kind = "bogus"
+
+	obj, err := r.getIssuer(istiocsr)
+	if obj != nil {
+		t.Errorf("expected nil object for unsupported kind, got %T", obj)
+	}
+	if err == nil {
+		t.Fatal("expected error for unsupported issuer kind")
+	}
+	if !strings.Contains(err.Error(), "unsupported issuer kind") {
+		t.Errorf("unexpected error message: %v", err)
+	}
+}
+
+func TestGetIssuerValidKinds(t *testing.T) {
+	tests := []struct {
+		name string
+		kind string
+	}{
+		{name: "issuer kind", kind: "Issuer"},
+		{name: "cluster issuer kind", kind: "ClusterIssuer"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fakeClient := &fakes.FakeCtrlClient{}
+			fakeClient.GetReturns(nil)
+
+			r := testReconciler(t)
+			r.CtrlClient = fakeClient
+
+			istiocsr := testIstioCSR()
+			istiocsr.Spec.IstioCSRConfig.CertManager.IssuerRef.Kind = tt.kind
+
+			obj, err := r.getIssuer(istiocsr)
+			if err != nil {
+				t.Fatalf("unexpected error for kind %q: %v", tt.kind, err)
+			}
+			if obj == nil {
+				t.Fatalf("expected non-nil object for kind %q", tt.kind)
+			}
+		})
+	}
+}