fix: skip adding image registry CA file when not set

Author: dkoshkin

pkg/handlers/generic/mutation/mirrors/containerd_files.go

@@ -19,7 +19,7 @@ import (
 
 const (
 	containerdHostsConfigurationOnRemote = "/etc/containerd/certs.d/_default/hosts.toml"
-	secretKeyForMirrorCACert             = "ca.crt"
+	secretKeyForCACert                   = "ca.crt"
 )
 
 var (
@@ -159,7 +159,7 @@ func generateRegistryCACertFiles(
 			ContentFrom: &cabpkv1.FileSource{
 				Secret: cabpkv1.SecretFileSource{
 					Name: config.CASecretName,
-					Key:  secretKeyForMirrorCACert,
+					Key:  secretKeyForCACert,
 				},
 			},
 		})

pkg/handlers/generic/mutation/mirrors/inject.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"fmt"
 
+	corev1 "k8s.io/api/core/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -193,9 +194,9 @@ func containerdConfigFromGlobalMirror(
 		)
 	}
 
-	if secret != nil {
+	if secretHasCACert(secret) {
 		configWithOptionalCACert.CASecretName = secret.Name
-		configWithOptionalCACert.CACert = string(secret.Data[secretKeyForMirrorCACert])
+		configWithOptionalCACert.CACert = string(secret.Data[secretKeyForCACert])
 	}
 
 	return configWithOptionalCACert, nil
@@ -225,9 +226,9 @@ func containerdConfigFromImageRegistry(
 		)
 	}
 
-	if secret != nil {
+	if secretHasCACert(secret) {
 		configWithOptionalCACert.CASecretName = secret.Name
-		configWithOptionalCACert.CACert = string(secret.Data[secretKeyForMirrorCACert])
+		configWithOptionalCACert.CACert = string(secret.Data[secretKeyForCACert])
 	}
 
 	return configWithOptionalCACert, nil
@@ -271,3 +272,12 @@ func needContainerdConfiguration(configs []containerdConfig) bool {
 
 	return false
 }
+
+func secretHasCACert(secret *corev1.Secret) bool {
+	if secret == nil {
+		return false
+	}
+
+	_, ok := secret.Data[secretKeyForCACert]
+	return ok
+}