fixup! fixup! fixup! runtime/secrets: add package for consolidated secret handling

improve TLS validation error messages

Signed-off-by: cappyzawa <[email protected]>

Author: cappyzawa

runtime/secrets/error.go

@@ -19,6 +19,8 @@ package secrets
 import (
 	"errors"
 	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
 )
 
 var (
@@ -38,3 +40,54 @@ func (e *KeyNotFoundError) Error() string {
 func (e *KeyNotFoundError) Is(target error) bool {
 	return errors.Is(target, ErrKeyNotFound)
 }
+
+// TLSValidationError represents TLS certificate validation errors.
+type TLSValidationError struct {
+	Type TLSValidationErrorType
+}
+
+// TLSValidationErrorType defines the type of TLS validation error.
+type TLSValidationErrorType int
+
+const (
+	// ErrMissingPrivateKey indicates that a certificate exists but the private key is missing.
+	ErrMissingPrivateKey TLSValidationErrorType = iota
+	// ErrMissingCertificate indicates that a private key exists but the certificate is missing.
+	ErrMissingCertificate
+	// ErrNoCertificatePairOrCA indicates that neither a certificate pair nor a CA certificate is present.
+	ErrNoCertificatePairOrCA
+)
+
+func (e *TLSValidationError) Error() string {
+	switch e.Type {
+	case ErrMissingPrivateKey:
+		return "found certificate but missing private key"
+	case ErrMissingCertificate:
+		return "found private key but missing certificate"
+	case ErrNoCertificatePairOrCA:
+		return "no CA certificate or client certificate pair found"
+	default:
+		return "TLS validation error"
+	}
+}
+
+// enhanceSecretValidationError enhances TLS validation errors with secret reference information.
+func enhanceSecretValidationError(err error, secret *corev1.Secret) error {
+	var tlsErr *TLSValidationError
+	if !errors.As(err, &tlsErr) {
+		return err
+	}
+
+	secretRef := fmt.Sprintf("'%s/%s'", secret.Namespace, secret.Name)
+
+	switch tlsErr.Type {
+	case ErrMissingPrivateKey:
+		return fmt.Errorf("secret %s contains '%s' but missing '%s'", secretRef, TLSCertKey, TLSKeyKey)
+	case ErrMissingCertificate:
+		return fmt.Errorf("secret %s contains '%s' but missing '%s'", secretRef, TLSKeyKey, TLSCertKey)
+	case ErrNoCertificatePairOrCA:
+		return fmt.Errorf("secret %s must contain either '%s' or both '%s' and '%s'", secretRef, CACertKey, TLSCertKey, TLSKeyKey)
+	default:
+		return err
+	}
+}

runtime/secrets/reader.go

@@ -47,7 +47,7 @@ func TLSConfigFromSecret(ctx context.Context, c client.Client, name, namespace s
 
 	certData, err := getTLSCertificateData(secret, options.supportDeprecatedFields)
 	if err != nil {
-		return nil, err
+		return nil, enhanceSecretValidationError(err, secret)
 	}
 
 	return buildTLSConfig(certData)

runtime/secrets/reader_test.go

@@ -228,7 +228,7 @@ func TestTLSConfigFromSecret(t *testing.T) {
 					secrets.TLSKeyFileKey:  tlsKey,
 				},
 			},
-			errMsg: "no CA certificate or client certificate pair found",
+			errMsg: "secret 'default/tls-secret' must contain either 'ca.crt' or both 'tls.crt' and 'tls.key'",
 		},
 		{
 			name: "invalid certificate data",
@@ -282,7 +282,7 @@ func TestTLSConfigFromSecret(t *testing.T) {
 					secrets.TLSCertKey: tlsCert,
 				},
 			},
-			errMsg: "found certificate but missing private key",
+			errMsg: "secret 'default/tls-secret' contains 'tls.crt' but missing 'tls.key'",
 		},
 		{
 			name: "key without certificate",
@@ -295,7 +295,7 @@ func TestTLSConfigFromSecret(t *testing.T) {
 					secrets.TLSKeyKey: tlsKey,
 				},
 			},
-			errMsg: "found private key but missing certificate",
+			errMsg: "secret 'default/tls-secret' contains 'tls.key' but missing 'tls.crt'",
 		},
 		{
 			name: "no certificates at all",
@@ -306,7 +306,7 @@ func TestTLSConfigFromSecret(t *testing.T) {
 				},
 				Data: map[string][]byte{},
 			},
-			errMsg: "no CA certificate or client certificate pair found",
+			errMsg: "secret 'default/tls-secret' must contain either 'ca.crt' or both 'tls.crt' and 'tls.key'",
 		},
 	}
 

runtime/secrets/secrets.go

@@ -82,13 +82,13 @@ func (t *tlsCertificateData) validate() error {
 
 	if hasCert != hasKey {
 		if hasCert {
-			return fmt.Errorf("found certificate but missing private key")
+			return &TLSValidationError{Type: ErrMissingPrivateKey}
 		}
-		return fmt.Errorf("found private key but missing certificate")
+		return &TLSValidationError{Type: ErrMissingCertificate}
 	}
 
 	if !hasCert && !hasCA {
-		return fmt.Errorf("no CA certificate or client certificate pair found")
+		return &TLSValidationError{Type: ErrNoCertificatePairOrCA}
 	}
 
 	return nil