fix: avoid panic on wireguard server controller

Author: fra98

pkg/liqo-controller-manager/networking/external-network/wireguard/wggatewayclient_controller.go

@@ -155,13 +155,6 @@ func (r *WgGatewayClientReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		r.eventRecorder.Event(wgClient, corev1.EventTypeNormal, "Reconciled", "WireGuard gateway client reconciled")
 	}()
 
-	if err := r.handleSecretRefStatus(ctx, wgClient); err != nil {
-		klog.Errorf("Error while handling secret ref status: %v", err)
-		r.eventRecorder.Event(wgClient, corev1.EventTypeWarning, "SecretRefStatusFailed",
-			fmt.Sprintf("Failed to handle secret ref status: %s", err))
-		return ctrl.Result{}, err
-	}
-
 	if err := r.handleInternalEndpointStatus(ctx, wgClient, deploy); err != nil {
 		klog.Errorf("Error while handling internal endpoint status: %v", err)
 		r.eventRecorder.Event(wgClient, corev1.EventTypeWarning, "InternalEndpointStatusFailed",
@@ -178,11 +171,19 @@ func (r *WgGatewayClientReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		}
 		r.eventRecorder.Event(wgClient, corev1.EventTypeNormal, "KeysSecretEnforced", "Enforced keys secret")
 	} else {
-		// Check if the secret exists and has the correct labels
+		// Check that the secret exists and is correctly labeled
 		if err = checkExistingKeysSecret(ctx, r.Client, wgClient.Spec.SecretRef.Name, wgClient.Namespace); err != nil {
 			r.eventRecorder.Event(wgClient, corev1.EventTypeWarning, "KeysSecretCheckFailed", fmt.Sprintf("Failed to check keys secret: %s", err))
 			return ctrl.Result{}, err
 		}
+		r.eventRecorder.Event(wgClient, corev1.EventTypeNormal, "KeysSecretChecked", "Checked keys secret")
+	}
+
+	if err := r.handleSecretRefStatus(ctx, wgClient); err != nil {
+		klog.Errorf("Error while handling secret ref status: %v", err)
+		r.eventRecorder.Event(wgClient, corev1.EventTypeWarning, "SecretRefStatusFailed",
+			fmt.Sprintf("Failed to handle secret ref status: %s", err))
+		return ctrl.Result{}, err
 	}
 
 	// Ensure deployment (create or update)

pkg/liqo-controller-manager/networking/external-network/wireguard/wggatewayserver_controller.go

@@ -164,20 +164,14 @@ func (r *WgGatewayServerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return ctrl.Result{}, err
 	}
 
-	if err := r.handleSecretRefStatus(ctx, wgServer); err != nil {
-		klog.Errorf("Error while handling secret ref status: %v", err)
-		r.eventRecorder.Event(wgServer, corev1.EventTypeWarning, "SecretRefStatusFailed",
-			fmt.Sprintf("Failed to handle secret ref status: %s", err))
-		return ctrl.Result{}, err
-	}
-
 	if err := r.handleInternalEndpointStatus(ctx, wgServer, svcNsName, deploy); err != nil {
 		klog.Errorf("Error while handling internal endpoint status: %v", err)
 		r.eventRecorder.Event(wgServer, corev1.EventTypeWarning, "InternalEndpointStatusFailed",
 			fmt.Sprintf("Failed to handle internal endpoint status: %s", err))
 		return ctrl.Result{}, err
 	}
 
+	// If a secret has not been provided in the gateway specification, the controller is in charge of generating a secret with the Wireguard keys.
 	if wgServer.Spec.SecretRef.Name == "" {
 		// Ensure WireGuard keys secret (create or update)
 		if err = ensureKeysSecret(ctx, r.Client, wgServer, gateway.ModeServer); err != nil {
@@ -187,13 +181,20 @@ func (r *WgGatewayServerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		r.eventRecorder.Event(wgServer, corev1.EventTypeNormal, "KeysSecretEnforced", "Enforced keys secret")
 	} else {
 		// Check that the secret exists and is correctly labeled
-		if err = checkExistingKeysSecret(ctx, r.Client, wgServer.Status.SecretRef.Name, wgServer.Namespace); err != nil {
+		if err = checkExistingKeysSecret(ctx, r.Client, wgServer.Spec.SecretRef.Name, wgServer.Namespace); err != nil {
 			r.eventRecorder.Event(wgServer, corev1.EventTypeWarning, "KeysSecretCheckFailed", fmt.Sprintf("Failed to check keys secret: %s", err))
 			return ctrl.Result{}, err
 		}
 		r.eventRecorder.Event(wgServer, corev1.EventTypeNormal, "KeysSecretChecked", "Checked keys secret")
 	}
 
+	if err := r.handleSecretRefStatus(ctx, wgServer); err != nil {
+		klog.Errorf("Error while handling secret ref status: %v", err)
+		r.eventRecorder.Event(wgServer, corev1.EventTypeWarning, "SecretRefStatusFailed",
+			fmt.Sprintf("Failed to handle secret ref status: %s", err))
+		return ctrl.Result{}, err
+	}
+
 	// Ensure deployment (create or update)
 	_, err = r.ensureDeployment(ctx, wgServer, deployNsName)
 	if err != nil {