combine CAs

Author: dprince

internal/controller/assistant/openstackassistant_controller.go

@@ -335,26 +335,39 @@ func (r *OpenStackAssistantReconciler) Reconcile(ctx context.Context, req ctrl.R
 		configVars["mcp-ca-bundle"] = env.SetValue(mcpCaHash)
 	}
 
-	// Build combined CA bundle when both lightspeed and MCP CA sources exist
+	// Build combined CA bundle when MCP TLS is in use, merging the internal CA
+	// (tls-ca-bundle.pem) with the lightspeed CA (ca-bundle.crt) if present.
+	// This handles same-secret, different-secret, and MCP-only cases.
 	hasCombinedCA := false
 	combinedCAPEM := ""
-	if instance.Spec.LightspeedStack.CaBundleSecretName != "" &&
-		mcpCaBundleSecretName != "" &&
-		mcpCaBundleSecretName != instance.Spec.LightspeedStack.CaBundleSecretName {
+	if mcpCaBundleSecretName != "" {
+		var lightspeedCA, mcpCA string
 
-		lightspeedCASecret, _, err := secret.GetSecret(ctx, helper, instance.Spec.LightspeedStack.CaBundleSecretName, instance.Namespace)
-		if err != nil {
-			return ctrl.Result{}, fmt.Errorf("error reading lightspeed CA secret: %w", err)
+		if instance.Spec.LightspeedStack.CaBundleSecretName != "" {
+			lightspeedCASecret, _, err := secret.GetSecret(ctx, helper, instance.Spec.LightspeedStack.CaBundleSecretName, instance.Namespace)
+			if err != nil {
+				return ctrl.Result{}, fmt.Errorf("error reading lightspeed CA secret: %w", err)
+			}
+			lightspeedCA = string(lightspeedCASecret.Data["ca-bundle.crt"])
+
+			if mcpCaBundleSecretName == instance.Spec.LightspeedStack.CaBundleSecretName {
+				mcpCA = string(lightspeedCASecret.Data["tls-ca-bundle.pem"])
+			}
 		}
-		mcpCASecret, _, err := secret.GetSecret(ctx, helper, mcpCaBundleSecretName, instance.Namespace)
-		if err != nil {
-			return ctrl.Result{}, fmt.Errorf("error reading MCP CA secret: %w", err)
+
+		if mcpCA == "" {
+			mcpCASecret, _, err := secret.GetSecret(ctx, helper, mcpCaBundleSecretName, instance.Namespace)
+			if err != nil {
+				return ctrl.Result{}, fmt.Errorf("error reading MCP CA secret: %w", err)
+			}
+			mcpCA = string(mcpCASecret.Data["tls-ca-bundle.pem"])
 		}
 
-		lightspeedCA := string(lightspeedCASecret.Data["ca-bundle.crt"])
-		mcpCA := string(mcpCASecret.Data["tls-ca-bundle.pem"])
-		if lightspeedCA != "" && mcpCA != "" {
-			combinedCAPEM = lightspeedCA + "\n" + mcpCA
+		if mcpCA != "" {
+			combinedCAPEM = mcpCA
+			if lightspeedCA != "" {
+				combinedCAPEM = lightspeedCA + "\n" + mcpCA
+			}
 			hasCombinedCA = true
 		}
 	}