Repository: apecloud/kubeblocks

Issue:
[BUG] `issuer.secretRef.namespace` is not optional
**Describe the bug**
The "namespace" field is defined as optional in TLSSecretRef, but in fact, if it is not set, the KubeBlocks controller will fail to reconcile, and consequently, the restart will not be triggered, preventing the TLS configuration from taking effect.

https://kubeblocks.io/docs/preview/user_docs/references/api-reference/cluster#apps.kubeblocks.io/v1.TLSSecretRef 


KubeBlocks manager logs:
```
2025-09-28T09:30:18.182Z	INFO	an empty namespace may not be set when a resource name is provided	{"controller": "component", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Component", "Component": {"name":"holly-5c97689c5c-postgresql","namespace":"kubeblocks-cloud-ns"}, "namespace": "kubeblocks-cloud-ns", "name": "holly-5c97689c5c-postgresql", "reconcileID": "8823c00f-f3c8-4544-9666-49acf6a24ecf", "component": {"name":"holly-5c97689c5c-postgresql","namespace":"kubeblocks-cloud-ns"}}
2025-09-28T09:30:18.182Z	ERROR	Reconciler error	{"controller": "component", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Component", "Component": {"name":"holly-5c97689c5c-postgresql","namespace":"kubeblocks-cloud-ns"}, "namespace": "kubeblocks-cloud-ns", "name": "holly-5c97689c5c-postgresql", "reconcileID": "8823c00f-f3c8-4544-9666-49acf6a24ecf", "error": "an empty namespace may not be set when a resource name is provided"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:227
2025-09-28T09:30:18.983Z	INFO	deleting the sub-resource kinds: []	{"controller": "cluster", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Cluster", "Cluster": {"name":"clove-678785bbdb","namespace":"kubeblocks-cloud-ns"}, "namespace": "kubeblocks-cloud-ns", "name": "clove-678785bbdb", "reconcileID": "993930b9-3a81-4d46-8405-d8a3b5df15f7", "cluster": {"name":"clove-678785bbdb","namespace":"kubeblocks-cloud-ns"}}
2025-09-28T09:30:20.006Z	INFO	deleting the sub-resource kinds: []	{"contr
```

**To Reproduce**
Enable TLS wihtout set namespace of TLSSecretRef

**Expected behavior**
As described by the field, if not set, the cluster's namespace should be used.


**Additional context**

Kubernetes: v1.32.7-aliyun.1
KubeBlocks: 1.0.2-beta.7
kbcli: 1.0.0-beta.22



Discussion:
@shanshanying: @leon-inf seems the default value (cluster namepace) is not set ?

Solution patch:
diff --git a/controllers/apps/component/transformer_component_tls.go b/controllers/apps/component/transformer_component_tls.go
index 6fb1f83e7..bf2894719 100644
--- a/controllers/apps/component/transformer_component_tls.go
+++ b/controllers/apps/component/transformer_component_tls.go
@@ -292,6 +292,9 @@ func (i *tlsIssuerUserProvided) referenced(ctx context.Context, cli client.Reade
 		Namespace: secretRef.Namespace,
 		Name:      secretRef.Name,
 	}
+	if len(secretKey.Namespace) == 0 {
+		secretKey.Namespace = i.synthesizedComp.Namespace
+	}
 	secret := &corev1.Secret{}
 	if err := cli.Get(ctx, secretKey, secret); err != nil {
 		return nil, err



Test patch:
diff --git a/controllers/apps/component/transformer_component_tls_test.go b/controllers/apps/component/transformer_component_tls_test.go
index 30c78e103..fa35ad978 100644
--- a/controllers/apps/component/transformer_component_tls_test.go
+++ b/controllers/apps/component/transformer_component_tls_test.go
@@ -68,7 +68,7 @@ var _ = Describe("TLS transformer test", func() {
 
 		tlsSecret4User = &corev1.Secret{
 			ObjectMeta: metav1.ObjectMeta{
-				Namespace: testCtx.DefaultNamespace,
+				Namespace: "default", // testCtx hasn't been initialized yet
 				Name:      "tls-secret-4-user",
 			},
 			Data: map[string][]byte{