fix: skip secret lookup when tls[].secretName is empty (fixes spurious warning with wildcard TLS) (#10543)

* fix: skip secret lookup when tls[].secretName is empty

When an Ingress has a tls: block with no secretName (relying on
--wildcard-tls-secret), createIngressEx() was unconditionally
attempting secretStore.GetSecret("namespace/") — an invalid key that
can never exist — and emitting a spurious warning on every sync:

  W controller.go] Error trying to get the secret  for Ingress <name>: secret doesn't exist or of an unsupported type

Note the double space: secretName is "" and prints as blank.

The downstream addSSLConfig() already handles this case correctly by
falling through to the wildcard cert path when secretName == "" and
isWildcardEnabled == true, so TLS works correctly. The warning is a
false positive.

Fix: guard the lookup with a secretName == "" check and store an
empty SecretReference{} instead. The downstream code path is
unchanged and wildcard TLS continues to work.

At scale (clusters with 3000+ wildcard-TLS ingresses) this removes
thousands of spurious warnings per resync and the reload pressure
they cause.

Fixes #10218

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Rahul Sawra <r.sawra@gmail.com>

---------

Signed-off-by: Rahul Sawra <r.sawra@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Venktesh Patel <ve.patel@f5.com>

Author: 3 people

internal/k8s/controller.go

@@ -2740,6 +2740,14 @@ func (lbc *LoadBalancerController) createIngressEx(ing *networking.Ingress, vali
 
 	for _, tls := range ing.Spec.TLS {
 		secretName := tls.SecretName
+		if secretName == "" {
+			// No secretName specified. Skip the store lookup to avoid a spurious
+			// "secret doesn't exist" warning on every sync of this Ingress.
+			// If --wildcard-tls-secret is configured, NGINX config generation will
+			// fall back to the wildcard TLS secret for this host.
+			ingEx.SecretRefs[secretName] = &secrets.SecretReference{}
+			continue
+		}
 		secretKey := ing.Namespace + "/" + secretName
 
 		secretRef := lbc.secretStore.GetSecret(secretKey)

internal/k8s/controller_test.go

@@ -2435,6 +2435,62 @@ func TestCreateIngressEx_SetsWarningWhenPoliciesAnnotationUsedWithoutCustomResou
 	}
 }
 
+func TestCreateIngressEx_NoSpuriousWarningWhenTLSSecretNameEmpty(t *testing.T) {
+	t.Parallel()
+
+	// Ingress with a tls: block that has no secretName — relies on --wildcard-tls-secret.
+	ing := createTestIngress("wildcard-tls-ingress", "example.com")
+	ing.Spec.TLS = []networking.IngressTLS{
+		{
+			Hosts: []string{"example.com"},
+			// SecretName intentionally absent — relying on wildcard TLS secret.
+		},
+	}
+
+	tests := []struct {
+		name              string
+		wildcardTLSSecret string
+	}{
+		{
+			name:              "wildcard TLS configured",
+			wildcardTLSSecret: "default/wildcard-tls-secret",
+		},
+		{
+			name:              "wildcard TLS not configured",
+			wildcardTLSSecret: "",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			lbc := LoadBalancerController{
+				namespacedInformers: map[string]*namespacedInformer{
+					"default": {},
+				},
+				secretStore: secrets.NewEmptyFakeSecretsStore(),
+				specialSecrets: specialSecrets{
+					wildcardTLSSecret: tc.wildcardTLSSecret,
+				},
+				Logger: nl.LoggerFromContext(context.Background()),
+			}
+
+			ingEx := lbc.createIngressEx(ing, map[string]bool{"example.com": true}, nil)
+
+			// The empty-secretName entry must be present in SecretRefs with no error —
+			// downstream addSSLConfig() reads this key and falls through to the wildcard path.
+			ref, exists := ingEx.SecretRefs[""]
+			if !exists {
+				t.Fatal("expected SecretRefs[\"\"] to exist for empty-secretName TLS block")
+			}
+			if ref.Error != nil {
+				t.Errorf("expected no error in SecretRefs[\"\"] when secretName is empty, got: %v", ref.Error)
+			}
+		})
+	}
+}
+
 func TestSyncPolicy_UpdatesMergeableIngressesWhenPolicyChanges(t *testing.T) {
 	t.Parallel()