test(trustmanager): add unit tests for trust namespace configuration

Add missing unit test coverage for configurable trust namespace feature.

The trust namespace configuration was already fully implemented in PR openshift#379.
This commit adds comprehensive unit tests to verify the implementation and
satisfy CM-869 acceptance criteria.

Tests added:
- Trust namespace validation when namespace doesn't exist
- Custom trust namespace configuration with successful reconciliation
- Status field updates for both default and custom namespace values

Without these tests, the trust namespace validation logic was not adequately
covered, making it harder to catch regressions.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: Arun Maurya

pkg/controller/trustmanager/controller_test.go

@@ -251,6 +251,82 @@ func TestProcessReconcileRequest(t *testing.T) {
 			},
 			wantErr: "failed to check if serviceaccount",
 		},
+		{
+			name: "trust namespace does not exist sets degraded true",
+			getTrustManager: func() *v1alpha1.TrustManager {
+				return testTrustManager().Build()
+			},
+			preReq: func(r *Reconciler, m *fakes.FakeCtrlClient) {
+				m.GetCalls(func(ctx context.Context, key client.ObjectKey, obj client.Object) error {
+					switch o := obj.(type) {
+					case *v1alpha1.TrustManager:
+						testTrustManager().Build().DeepCopyInto(o)
+					}
+					return nil
+				})
+				// Namespace does not exist - validateTrustNamespace will fail
+				m.ExistsCalls(func(ctx context.Context, key client.ObjectKey, obj client.Object) (bool, error) {
+					switch obj.(type) {
+					case *corev1.Namespace:
+						return false, nil
+					}
+					return false, nil
+				})
+			},
+			wantConditions: []metav1.Condition{
+				{
+					Type:   v1alpha1.Degraded,
+					Status: metav1.ConditionTrue,
+					Reason: v1alpha1.ReasonFailed,
+				},
+				{
+					Type:   v1alpha1.Ready,
+					Status: metav1.ConditionFalse,
+					Reason: v1alpha1.ReasonFailed,
+				},
+			},
+		},
+		{
+			name: "custom trust namespace configures resources correctly",
+			getTrustManager: func() *v1alpha1.TrustManager {
+				tm := testTrustManager().Build()
+				tm.Spec.TrustManagerConfig.TrustNamespace = "custom-trust-ns"
+				return tm
+			},
+			preReq: func(r *Reconciler, m *fakes.FakeCtrlClient) {
+				m.GetCalls(func(ctx context.Context, key client.ObjectKey, obj client.Object) error {
+					switch o := obj.(type) {
+					case *v1alpha1.TrustManager:
+						tm := testTrustManager().Build()
+						tm.Spec.TrustManagerConfig.TrustNamespace = "custom-trust-ns"
+						tm.DeepCopyInto(o)
+					}
+					return nil
+				})
+				// Custom namespace exists; all other resources return not-found so they
+				// are created via SSA Patch (which succeeds by default).
+				m.ExistsCalls(func(ctx context.Context, key client.ObjectKey, obj client.Object) (bool, error) {
+					switch obj.(type) {
+					case *corev1.Namespace:
+						return true, nil
+					}
+					return false, nil
+				})
+			},
+			wantConditions: []metav1.Condition{
+				{
+					Type:   v1alpha1.Degraded,
+					Status: metav1.ConditionFalse,
+					Reason: v1alpha1.ReasonReady,
+				},
+				{
+					Type:    v1alpha1.Ready,
+					Status:  metav1.ConditionTrue,
+					Reason:  v1alpha1.ReasonReady,
+					Message: "reconciliation successful",
+				},
+			},
+		},
 	}
 
 	for _, tt := range tests {
@@ -289,3 +365,60 @@ func TestProcessReconcileRequest(t *testing.T) {
 		})
 	}
 }
+
+func TestStatusTrustNamespaceUpdate(t *testing.T) {
+	t.Setenv(trustManagerImageNameEnvVarName, testImage)
+
+	tests := []struct {
+		name               string
+		trustNamespace     string
+		wantTrustNamespace string
+	}{
+		{
+			name:               "default trust namespace is set in status",
+			trustNamespace:     "",
+			wantTrustNamespace: defaultTrustNamespace,
+		},
+		{
+			name:               "custom trust namespace is set in status",
+			trustNamespace:     "custom-trust-ns",
+			wantTrustNamespace: "custom-trust-ns",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := testReconciler(t)
+			mock := &fakes.FakeCtrlClient{}
+
+			mock.GetCalls(func(ctx context.Context, key client.ObjectKey, obj client.Object) error {
+				switch o := obj.(type) {
+				case *v1alpha1.TrustManager:
+					tm := testTrustManager().WithTrustNamespace(tt.trustNamespace).Build()
+					tm.DeepCopyInto(o)
+				}
+				return nil
+			})
+
+			mock.ExistsCalls(func(ctx context.Context, key client.ObjectKey, obj client.Object) (bool, error) {
+				switch obj.(type) {
+				case *corev1.Namespace:
+					return true, nil
+				}
+				return false, nil
+			})
+
+			r.CtrlClient = mock
+
+			tm := testTrustManager().WithTrustNamespace(tt.trustNamespace).Build()
+			_, err := r.processReconcileRequest(tm, types.NamespacedName{Name: tm.GetName()})
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if tm.Status.TrustNamespace != tt.wantTrustNamespace {
+				t.Errorf("expected status.trustNamespace %q, got %q", tt.wantTrustNamespace, tm.Status.TrustNamespace)
+			}
+		})
+	}
+}

pkg/controller/trustmanager/test_utils.go

@@ -69,6 +69,11 @@ func (b *trustManagerBuilder) WithAffinity(affinity *corev1.Affinity) *trustMana
 	return b
 }
 
+func (b *trustManagerBuilder) WithTrustNamespace(trustNamespace string) *trustManagerBuilder {
+	b.Spec.TrustManagerConfig.TrustNamespace = trustNamespace
+	return b
+}
+
 func (b *trustManagerBuilder) Build() *v1alpha1.TrustManager {
 	return b.TrustManager
 }

pkg/controller/trustmanager/webhooks.go

@@ -52,7 +52,7 @@ func getValidatingWebhookConfigObject(resourceLabels, resourceAnnotations map[st
 	return webhookConfig
 }
 
-// updateWebhookClientConfig sets the webhook clientConfig service name and namespace
+// updateWebhookClientConfig sets the webhook clientConfig service name and namespace.
 func updateWebhookClientConfig(webhookConfig *admissionregistrationv1.ValidatingWebhookConfiguration) {
 	for i := range webhookConfig.Webhooks {
 		if webhookConfig.Webhooks[i].ClientConfig.Service != nil {