Replace the OIDCProvider field SNICertificateSecretName with a TLS.SecretName field.

Signed-off-by: Matt Moyer <moyerm@vmware.com>

internal/controller/supervisorconfig/oidcproviderconfig_watcher.go

@@ -102,7 +102,9 @@ func (c *oidcProviderWatcherController) Sync(ctx controllerlib.Context) error {
 			setOfSecretNames = make(map[string]bool)
 			uniqueSecretNamesPerIssuerAddress[issuerURLToHostnameKey(issuerURL)] = setOfSecretNames
 		}
-		setOfSecretNames[opc.Spec.SNICertificateSecretName] = true
+		if opc.Spec.TLS != nil {
+			setOfSecretNames[opc.Spec.TLS.SecretName] = true
+		}
 	}
 
 	errs := multierror.New()

internal/controller/supervisorconfig/oidcproviderconfig_watcher_test.go

@@ -819,8 +819,8 @@ func TestSync(t *testing.T) {
 				oidcProviderSameIssuerAddress1 = &v1alpha1.OIDCProvider{
 					ObjectMeta: metav1.ObjectMeta{Name: "provider1", Namespace: namespace},
 					Spec: v1alpha1.OIDCProviderSpec{
-						Issuer:                   "https://iSSueR-duPlicAte-adDress.cOm/path1",
-						SNICertificateSecretName: "secret1",
+						Issuer: "https://iSSueR-duPlicAte-adDress.cOm/path1",
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: "secret1"},
 					},
 				}
 				r.NoError(pinnipedAPIClient.Tracker().Add(oidcProviderSameIssuerAddress1))
@@ -830,8 +830,8 @@ func TestSync(t *testing.T) {
 					Spec: v1alpha1.OIDCProviderSpec{
 						// Validation treats these as the same DNS hostname even though they have different port numbers,
 						// because SNI information on the incoming requests is not going to include port numbers.
-						Issuer:                   "https://issuer-duplicate-address.com:1234/path2",
-						SNICertificateSecretName: "secret2",
+						Issuer: "https://issuer-duplicate-address.com:1234/path2",
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: "secret2"},
 					},
 				}
 				r.NoError(pinnipedAPIClient.Tracker().Add(oidcProviderSameIssuerAddress2))
@@ -840,8 +840,8 @@ func TestSync(t *testing.T) {
 				oidcProviderDifferentIssuerAddress = &v1alpha1.OIDCProvider{
 					ObjectMeta: metav1.ObjectMeta{Name: "differentIssuerAddressProvider", Namespace: namespace},
 					Spec: v1alpha1.OIDCProviderSpec{
-						Issuer:                   "https://issuer-not-duplicate.com",
-						SNICertificateSecretName: "secret1",
+						Issuer: "https://issuer-not-duplicate.com",
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: "secret1"},
 					},
 				}
 				r.NoError(pinnipedAPIClient.Tracker().Add(oidcProviderDifferentIssuerAddress))
@@ -855,8 +855,8 @@ func TestSync(t *testing.T) {
 				oidcProviderWithInvalidIssuerURL = &v1alpha1.OIDCProvider{
 					ObjectMeta: metav1.ObjectMeta{Name: "invalidIssuerURLProvider", Namespace: namespace},
 					Spec: v1alpha1.OIDCProviderSpec{
-						Issuer:                   invalidIssuerURL,
-						SNICertificateSecretName: "secret1",
+						Issuer: invalidIssuerURL,
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: "secret1"},
 					},
 				}
 				r.NoError(pinnipedAPIClient.Tracker().Add(oidcProviderWithInvalidIssuerURL))

internal/controller/supervisorconfig/tls_cert_observer.go

@@ -72,7 +72,10 @@ func (c *tlsCertObserverController) Sync(ctx controllerlib.Context) error {
 	issuerHostToTLSCertMap := map[string]*tls.Certificate{}
 
 	for _, provider := range allProviders {
-		secretName := provider.Spec.SNICertificateSecretName
+		secretName := ""
+		if provider.Spec.TLS != nil {
+			secretName = provider.Spec.TLS.SecretName
+		}
 		issuerURL, err := url.Parse(provider.Spec.Issuer)
 		if err != nil {
 			klog.InfoS("tlsCertObserverController Sync found an invalid issuer URL", "namespace", ns, "issuer", provider.Spec.Issuer)

internal/controller/supervisorconfig/tls_cert_observer_test.go

@@ -225,8 +225,8 @@ func TestTLSCertObserverControllerSync(t *testing.T) {
 						Namespace: installedInNamespace,
 					},
 					Spec: v1alpha1.OIDCProviderSpec{
-						Issuer:                   "https://no-secret-issuer2.com",
-						SNICertificateSecretName: "",
+						Issuer: "https://no-secret-issuer2.com",
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: ""},
 					},
 				}
 				oidcProviderWithBadSecret := &v1alpha1.OIDCProvider{
@@ -235,8 +235,8 @@ func TestTLSCertObserverControllerSync(t *testing.T) {
 						Namespace: installedInNamespace,
 					},
 					Spec: v1alpha1.OIDCProviderSpec{
-						Issuer:                   "https://bad-secret-issuer.com",
-						SNICertificateSecretName: "bad-tls-secret-name",
+						Issuer: "https://bad-secret-issuer.com",
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: "bad-tls-secret-name"},
 					},
 				}
 				// Also add one with a URL that cannot be parsed to make sure that the controller is not confused by invalid URLs.
@@ -257,8 +257,8 @@ func TestTLSCertObserverControllerSync(t *testing.T) {
 					},
 					// Issuer hostname should be treated in a case-insensitive way and SNI ignores port numbers. Test without a port number.
 					Spec: v1alpha1.OIDCProviderSpec{
-						Issuer:                   "https://www.iSSuer-wiTh-goOd-secRet1.cOm/path",
-						SNICertificateSecretName: "good-tls-secret-name1",
+						Issuer: "https://www.iSSuer-wiTh-goOd-secRet1.cOm/path",
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: "good-tls-secret-name1"},
 					},
 				}
 				oidcProviderWithGoodSecret2 := &v1alpha1.OIDCProvider{
@@ -268,8 +268,8 @@ func TestTLSCertObserverControllerSync(t *testing.T) {
 					},
 					// Issuer hostname should be treated in a case-insensitive way and SNI ignores port numbers. Test with a port number.
 					Spec: v1alpha1.OIDCProviderSpec{
-						Issuer:                   "https://www.issUEr-WIth-gOOd-seCret2.com:1234/path",
-						SNICertificateSecretName: "good-tls-secret-name2",
+						Issuer: "https://www.issUEr-WIth-gOOd-seCret2.com:1234/path",
+						TLS:    &v1alpha1.OIDCProviderTLSSpec{SecretName: "good-tls-secret-name2"},
 					},
 				}
 				testCrt1 := readTestFile("testdata/test.crt")