fix: force insecure: false with additionalTrustBundle

Author: dkoshkin

pkg/handlers/nutanix/mutation/prismcentralendpoint/inject.go

@@ -122,6 +122,13 @@ func (h *nutanixPrismCentralEndpoint) Mutate(
 				}
 			}
 
+			// Always force insecure to false if additional trust bundle is provided.
+			// This ensures that the trust bundle is actually used to validate the connection.
+			if additionalTrustBundle != "" && prismCentral.Insecure {
+				log.Info("AdditionalTrustBundle is provided, setting insecure to false")
+				prismCentral.Insecure = false
+			}
+
 			obj.Spec.Template.Spec.PrismCentral = prismCentral
 
 			return nil

pkg/handlers/nutanix/mutation/prismcentralendpoint/tests/generate_patches.go

@@ -33,14 +33,48 @@ func TestGeneratePatches(
 			Name: "unset variable",
 		},
 		capitest.PatchTestDef{
-			Name: "all fields set",
+			Name: "all required fields set",
 			Vars: []runtimehooksv1.Variable{
 				capitest.VariableWithValue(
 					variableName,
 					v1alpha1.NutanixPrismCentralEndpointSpec{
 						Host:     "prism-central.nutanix.com",
 						Port:     9441,
-						Insecure: false,
+						Insecure: true,
+						Credentials: corev1.LocalObjectReference{
+							Name: "credentials",
+						},
+					},
+					variablePath...,
+				),
+			},
+			RequestItem: request.NewNutanixClusterTemplateRequestItem(""),
+			ExpectedPatchMatchers: []capitest.JSONPatchMatcher{
+				{
+					Operation: "replace",
+					Path:      "/spec/template/spec/prismCentral",
+					ValueMatcher: gomega.SatisfyAll(
+						gomega.HaveKeyWithValue(
+							"address",
+							gomega.BeEquivalentTo("prism-central.nutanix.com"),
+						),
+						gomega.HaveKeyWithValue("port", gomega.BeEquivalentTo(9441)),
+						gomega.HaveKeyWithValue("insecure", true),
+						gomega.HaveKey("credentialRef"),
+						gomega.Not(gomega.HaveKey("additionalTrustBundle")),
+					),
+				},
+			},
+		},
+		capitest.PatchTestDef{
+			Name: "additional trust bundle is set",
+			Vars: []runtimehooksv1.Variable{
+				capitest.VariableWithValue(
+					variableName,
+					v1alpha1.NutanixPrismCentralEndpointSpec{
+						Host:     "prism-central.nutanix.com",
+						Port:     9441,
+						Insecure: true,
 						Credentials: corev1.LocalObjectReference{
 							Name: "credentials",
 						},
@@ -60,6 +94,7 @@ func TestGeneratePatches(
 							gomega.BeEquivalentTo("prism-central.nutanix.com"),
 						),
 						gomega.HaveKeyWithValue("port", gomega.BeEquivalentTo(9441)),
+						// Assert the insecure field was set to false as the additional trust bundle is set
 						gomega.HaveKeyWithValue("insecure", false),
 						gomega.HaveKey("credentialRef"),
 						gomega.HaveKey("additionalTrustBundle"),