Repository: istio/istio
File: pilot/pkg/bootstrap/istio_ca.go (Go)

Code before:
	return raServer, err
}

// checkCABundleCompleteness checks if all required CA certificate files exist
func checkCABundleCompleteness(signingKeyFile, signingCertFile, rootCertFile string, chainFiles []string) (signingCABundleComplete bool, bundleExists bool) {
	signingKeyExists := fileExists(signingKeyFile)
	signingCertExists := fileExists(signingCertFile)
	rootCertExists := fileExists(rootCertFile)
	chainFilesExist := hasValidChainFiles(chainFiles)

	bundleExists = signingKeyExists || signingCertExists || rootCertExists || chainFilesExist
	signingCABundleComplete = signingKeyExists && signingCertExists && rootCertExists && chainFilesExist

	return signingCABundleComplete, bundleExists
}

// fileExists checks if a file exists and is accessible
func fileExists(filename string) bool {
	if filename == "" {
		return false
	}
	_, err := os.Stat(filename)
	if err != nil && !os.IsNotExist(err) {
		log.Warnf("Unexpected error checking file %s: %v", filename, err)
	}
	return err == nil
}

// hasValidChainFiles checks if there is at least one valid cert chain file
func hasValidChainFiles(files []string) bool {
	if len(files) == 0 {
		return false
	}

	for _, file := range files {
		if fileExists(file) {
			return true
		}
	}
	return false
}


Review comment (bug):
nit - for the sake of keeping the function more flexible in the future, why not return the error and then let the caller determine what to do with it? Like the caller could be responsible for any retry logic, failure, or other error processing if it knows that there's an error vs if the file doesn't actually exist.

This would entail having two return values though, both the boolean and the error value. Not super important just a thought.

Code after:
	}
	raServer.SetCACertificatesFromMeshConfig(s.environment.Mesh().CaCertificates)
	s.environment.AddMeshHandler(func() {
		meshConfig := s.environment.Mesh()
		caCertificates := meshConfig.CaCertificates
		s.RA.SetCACertificatesFromMeshConfig(caCertificates)
	})
	return raServer, err
}

// checkCABundleCompleteness checks if all required CA certificate files exist
// this function may return bundleExists as false even when some files exist in case of an error
func checkCABundleCompleteness(
	signingKeyFile, signingCertFile, rootCertFile string,
	chainFiles []string,
) (
	signingCABundleComplete bool,
	bundleExists bool,
	err error,
) {
	signingKeyExists, err := fileExists(signingKeyFile)
	if err != nil {
		return false, false, err
	}

	signingCertExists, err := fileExists(signingCertFile)
	if err != nil {
		return false, signingKeyExists, err
	}

	rootCertExists, err := fileExists(rootCertFile)
	if err != nil {
		return false, signingKeyExists || signingCertExists, err
	}

	chainFilesExist, err := hasValidChainFiles(chainFiles)
	if err != nil {
		return false, signingKeyExists || signingCertExists || rootCertExists, err
	}

	bundleExists = signingKeyExists || signingCertExists || rootCertExists || chainFilesExist
	signingCABundleComplete = signingKeyExists && signingCertExists && rootCertExists && chainFilesExist

	return signingCABundleComplete, bundleExists, nil
}

// fileExists checks if a file exists and is accessible
func fileExists(filename string) (bool, error) {
	if filename == "" {
		return false, nil
	}