[federation] Fix CA bundle secret name resolving to empty string

Ansible's default() filter (without boolean=True) only substitutes
Undefined values, not empty strings.  cifmw_custom_ca_certs_secret_name
is defined as "" in defaults/main.yml, so:

  | default(cifmw_custom_ca_certs_secret_name | default('custom-ca-certs'))

evaluated the inner default() to "" (defined, not undefined), and the
outer default() then received "" instead of Undefined, leaving the
secret name empty and causing the kubernetes.core.k8s task to fail
with "metadata.name: Required value".

Fix by passing true as the second argument to both default() calls so
that falsy values (including empty strings) are also replaced.

Affects hook_controlplane_config.yml and update-central-ca-bundle.yaml.

Made-with: Cursor
Signed-off-by: Ade Lee <alee@redhat.com>
Co-Authored-By: Claude <noreply@anthropic.com>

Author: 2 people

hooks/playbooks/skmo/update-central-ca-bundle.yaml

@@ -30,8 +30,8 @@
         _ca_bundle_secret_name: >-
           {{
             ((_central_oscp_info.resources | first).spec.tls | default({})).caBundleSecretName
-            | default(cifmw_custom_ca_certs_secret_name | default('custom-ca-certs'))
-            | default('custom-ca-certs')
+            | default(cifmw_custom_ca_certs_secret_name | default('custom-ca-certs', true), true)
+            | default('custom-ca-certs', true)
           }}
         _oscp_has_ca_bundle: >-
           {{

roles/federation/tasks/hook_controlplane_config.yml

@@ -48,8 +48,8 @@
     _federation_ca_bundle_secret_name: >-
       {{
         ((_federation_oscp_info.resources | first).spec.tls | default({})).caBundleSecretName
-        | default(cifmw_custom_ca_certs_secret_name | default('custom-ca-certs'))
-        | default('custom-ca-certs')
+        | default(cifmw_custom_ca_certs_secret_name | default('custom-ca-certs', true), true)
+        | default('custom-ca-certs', true)
       }}
     _federation_oscp_has_ca_bundle: >-
       {{