fix: deduplicate cert secret volumes for shared names

Author: ThomasK33

internal/controller/codercontrolplane_controller.go

@@ -1012,7 +1012,20 @@ func (r *CoderControlPlaneReconciler) reconcileDeployment(ctx context.Context, c
 			})
 		}
 
-		for _, secret := range coderControlPlane.Spec.Certs.Secrets {
+		certSecretNameCounts := make(map[string]int, len(coderControlPlane.Spec.Certs.Secrets))
+		for i := range coderControlPlane.Spec.Certs.Secrets {
+			secretName := strings.TrimSpace(coderControlPlane.Spec.Certs.Secrets[i].Name)
+			if secretName == "" {
+				continue
+			}
+			certSecretNameCounts[secretName]++
+		}
+
+		certVolumeNameBySecret := make(map[string]string, len(certSecretNameCounts))
+		certMountFileCount := make(map[string]int, len(coderControlPlane.Spec.Certs.Secrets))
+		certSelectorSeen := make(map[string]struct{}, len(coderControlPlane.Spec.Certs.Secrets))
+		for i := range coderControlPlane.Spec.Certs.Secrets {
+			secret := coderControlPlane.Spec.Certs.Secrets[i]
 			secret.Name = strings.TrimSpace(secret.Name)
 			secret.Key = strings.TrimSpace(secret.Key)
 			if secret.Name == "" {
@@ -1022,16 +1035,43 @@ func (r *CoderControlPlaneReconciler) reconcileDeployment(ctx context.Context, c
 				return fmt.Errorf("assertion failed: cert secret key must not be empty")
 			}
 
-			volumeName := volumeNameForSecret("ca-cert", secret.Name)
-			volumes = append(volumes, corev1.Volume{
-				Name: volumeName,
-				VolumeSource: corev1.VolumeSource{
-					Secret: &corev1.SecretVolumeSource{SecretName: secret.Name},
-				},
-			})
+			selectorKey := fmt.Sprintf("%s\x00%s", secret.Name, secret.Key)
+			if _, seen := certSelectorSeen[selectorKey]; seen {
+				continue
+			}
+			certSelectorSeen[selectorKey] = struct{}{}
+
+			volumeName, volumeExists := certVolumeNameBySecret[secret.Name]
+			if !volumeExists {
+				volumeName = volumeNameForSecret("ca-cert", secret.Name)
+				certVolumeNameBySecret[secret.Name] = volumeName
+				volumes = append(volumes, corev1.Volume{
+					Name: volumeName,
+					VolumeSource: corev1.VolumeSource{
+						Secret: &corev1.SecretVolumeSource{SecretName: secret.Name},
+					},
+				})
+			}
+
+			mountFileBase := secret.Name
+			if certSecretNameCounts[secret.Name] > 1 {
+				mountFileBase = fmt.Sprintf("%s-%s", secret.Name, secret.Key)
+			}
+			mountFileCount := certMountFileCount[mountFileBase]
+			certMountFileCount[mountFileBase] = mountFileCount + 1
+
+			mountFileName := mountFileBase
+			if !strings.HasSuffix(mountFileName, ".crt") {
+				mountFileName += ".crt"
+			}
+			if mountFileCount > 0 {
+				mountFileName = strings.TrimSuffix(mountFileName, ".crt")
+				mountFileName = fmt.Sprintf("%s-%d.crt", mountFileName, mountFileCount+1)
+			}
+
 			volumeMounts = append(volumeMounts, corev1.VolumeMount{
 				Name:      volumeName,
-				MountPath: fmt.Sprintf("/etc/ssl/certs/%s.crt", secret.Name),
+				MountPath: fmt.Sprintf("/etc/ssl/certs/%s", mountFileName),
 				SubPath:   secret.Key,
 				ReadOnly:  true,
 			})

internal/controller/codercontrolplane_controller_test.go

@@ -3644,6 +3644,77 @@ func TestReconcile_TLSAndCertSecretVolumeNameSanitization(t *testing.T) {
 	}
 }
 
+func TestReconcile_CertSecretsWithSharedSecretNameReuseVolume(t *testing.T) {
+	ensureGatewaySchemeRegistered(t)
+	ctx := context.Background()
+
+	cp := &coderv1alpha1.CoderControlPlane{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-cert-secret-shared-volume", Namespace: "default"},
+		Spec: coderv1alpha1.CoderControlPlaneSpec{
+			Image: "test-certs-shared-volume:latest",
+			Certs: coderv1alpha1.CertsSpec{
+				Secrets: []coderv1alpha1.CertSecretSelector{
+					{Name: "shared.ca.secret", Key: "ca.crt"},
+					{Name: "shared.ca.secret", Key: "alt.crt"},
+				},
+			},
+		},
+	}
+	if err := k8sClient.Create(ctx, cp); err != nil {
+		t.Fatalf("create control plane: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = k8sClient.Delete(ctx, cp)
+	})
+
+	r := &controller.CoderControlPlaneReconciler{Client: k8sClient, Scheme: scheme}
+	if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}}); err != nil {
+		t.Fatalf("reconcile control plane: %v", err)
+	}
+
+	deployment := &appsv1.Deployment{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}, deployment); err != nil {
+		t.Fatalf("get deployment: %v", err)
+	}
+	podSpec := deployment.Spec.Template.Spec
+	container := podSpec.Containers[0]
+
+	certVolumeName := ""
+	certVolumeCount := 0
+	for _, volume := range podSpec.Volumes {
+		if volume.Secret == nil || volume.Secret.SecretName != "shared.ca.secret" {
+			continue
+		}
+		certVolumeCount++
+		certVolumeName = volume.Name
+	}
+	if certVolumeCount != 1 {
+		t.Fatalf("expected exactly one cert volume for shared secret, got %d volumes: %+v", certVolumeCount, podSpec.Volumes)
+	}
+
+	expectedMountBySubPath := map[string]string{
+		"ca.crt":  "/etc/ssl/certs/shared.ca.secret-ca.crt",
+		"alt.crt": "/etc/ssl/certs/shared.ca.secret-alt.crt",
+	}
+	mountCount := 0
+	for _, mount := range container.VolumeMounts {
+		if mount.Name != certVolumeName {
+			continue
+		}
+		expectedPath, ok := expectedMountBySubPath[mount.SubPath]
+		if !ok {
+			t.Fatalf("unexpected cert subPath %q for mount %#v", mount.SubPath, mount)
+		}
+		if mount.MountPath != expectedPath {
+			t.Fatalf("expected mount path %q for subPath %q, got %q", expectedPath, mount.SubPath, mount.MountPath)
+		}
+		mountCount++
+	}
+	if mountCount != len(expectedMountBySubPath) {
+		t.Fatalf("expected %d cert volume mounts for shared secret, got %d mounts: %+v", len(expectedMountBySubPath), mountCount, container.VolumeMounts)
+	}
+}
+
 func TestReconcile_PassThroughConfiguration(t *testing.T) {
 	ensureGatewaySchemeRegistered(t)
 	ctx := context.Background()