webhookcachefiller and jwtcachefiller always update status when needed

Even when the authenticator is found in the cache, try to update its
status. Failing to do so would mean that the actual status will not
be overwritten by the controller's newly computed desired status.

Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>

test/integration/concierge_jwtauthenticator_status_test.go

@@ -115,6 +115,48 @@ func TestConciergeJWTAuthenticatorWithExternalCABundleStatusIsUpdatedWhenExterna
 	}
 }
 
+func TestConciergeJWTAuthenticatorStatusShouldBeOverwrittenByControllerAfterAnyManualEdits_Parallel(t *testing.T) {
+	env := testlib.IntegrationEnv(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	t.Cleanup(cancel)
+
+	conciergeClient := testlib.NewConciergeClientset(t)
+
+	// Run several times because there is always a chance that the test could pass because the controller
+	// will resync every 3 minutes even if it does not pay attention to changes in status.
+	for i := range 3 {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			t.Parallel()
+
+			authenticator := testlib.CreateTestJWTAuthenticator(ctx, t, authenticationv1alpha1.JWTAuthenticatorSpec{
+				Issuer:   env.SupervisorUpstreamOIDC.Issuer,
+				Audience: "does-not-matter",
+				TLS: &authenticationv1alpha1.TLSSpec{
+					CertificateAuthorityData: base64.StdEncoding.EncodeToString([]byte(env.SupervisorUpstreamOIDC.CABundle)),
+				},
+			}, authenticationv1alpha1.JWTAuthenticatorPhaseReady)
+
+			updatedAuthenticator, err := conciergeClient.AuthenticationV1alpha1().JWTAuthenticators().Get(ctx, authenticator.Name, metav1.GetOptions{})
+			require.NoError(t, err)
+
+			updatedAuthenticator.Status.Phase = "Pending"
+			originalFirstConditionMessage := updatedAuthenticator.Status.Conditions[0].Message
+			updatedAuthenticator.Status.Conditions[0].Message = "this is a manually edited message that should go away"
+			_, err = conciergeClient.AuthenticationV1alpha1().JWTAuthenticators().UpdateStatus(ctx, updatedAuthenticator, metav1.UpdateOptions{})
+			require.NoError(t, err)
+
+			testlib.RequireEventually(t, func(requireEventually *require.Assertions) {
+				gotAuthenticator, err := conciergeClient.AuthenticationV1alpha1().JWTAuthenticators().Get(ctx, authenticator.Name, metav1.GetOptions{})
+				requireEventually.NoError(err)
+				requireEventually.Equal(authenticationv1alpha1.JWTAuthenticatorPhaseReady, gotAuthenticator.Status.Phase,
+					"the controller should have changed the phase back to Ready")
+				requireEventually.Equal(originalFirstConditionMessage, gotAuthenticator.Status.Conditions[0].Message,
+					"the controller should have changed the message back to the correct value but it didn't")
+			}, 30*time.Second, 250*time.Millisecond)
+		})
+	}
+}
+
 func TestConciergeJWTAuthenticatorStatus_Parallel(t *testing.T) {
 	env := testlib.IntegrationEnv(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)

test/integration/concierge_webhookauthenticator_status_test.go

@@ -112,6 +112,42 @@ func TestConciergeWebhookAuthenticatorWithExternalCABundleStatusIsUpdatedWhenExt
 	}
 }
 
+func TestConciergeWebhookAuthenticatorStatusShouldBeOverwrittenByControllerAfterAnyManualEdits_Parallel(t *testing.T) {
+	env := testlib.IntegrationEnv(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	t.Cleanup(cancel)
+
+	conciergeClient := testlib.NewConciergeClientset(t)
+
+	// Run several times because there is always a chance that the test could pass because the controller
+	// will resync every 3 minutes even if it does not pay attention to changes in status.
+	for i := range 3 {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			t.Parallel()
+
+			authenticator := testlib.CreateTestWebhookAuthenticator(ctx, t, &env.TestWebhook, authenticationv1alpha1.WebhookAuthenticatorPhaseReady)
+
+			updatedAuthenticator, err := conciergeClient.AuthenticationV1alpha1().WebhookAuthenticators().Get(ctx, authenticator.Name, metav1.GetOptions{})
+			require.NoError(t, err)
+
+			updatedAuthenticator.Status.Phase = "Pending"
+			originalFirstConditionMessage := updatedAuthenticator.Status.Conditions[0].Message
+			updatedAuthenticator.Status.Conditions[0].Message = "this is a manually edited message that should go away"
+			_, err = conciergeClient.AuthenticationV1alpha1().WebhookAuthenticators().UpdateStatus(ctx, updatedAuthenticator, metav1.UpdateOptions{})
+			require.NoError(t, err)
+
+			testlib.RequireEventually(t, func(requireEventually *require.Assertions) {
+				gotAuthenticator, err := conciergeClient.AuthenticationV1alpha1().WebhookAuthenticators().Get(ctx, authenticator.Name, metav1.GetOptions{})
+				requireEventually.NoError(err)
+				requireEventually.Equal(authenticationv1alpha1.WebhookAuthenticatorPhaseReady, gotAuthenticator.Status.Phase,
+					"the controller should have changed the phase back to Ready")
+				requireEventually.Equal(originalFirstConditionMessage, gotAuthenticator.Status.Conditions[0].Message,
+					"the controller should have changed the message back to the correct value but it didn't")
+			}, 30*time.Second, 250*time.Millisecond)
+		})
+	}
+}
+
 func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 	env := testlib.IntegrationEnv(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)