validate the presence of specified cluster or clusterisssuer in tlspo…

…licy

pkg/controllers/tlspolicy/tlspolicy_controller.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 
 	"github.com/go-logr/logr"
+	v1 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
 
 	"k8s.io/apimachinery/pkg/api/equality"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -151,6 +152,25 @@ func (r *TLSPolicyReconciler) reconcileResources(ctx context.Context, tlsPolicy
 		return err
 	}
 
+	// validate that the issuer specified exists
+	issuerName := tlsPolicy.Spec.IssuerRef.Name
+	issuerKind := tlsPolicy.Spec.IssuerRef.Kind
+	var issuer client.Object
+	issuerNamespace := ""
+	if issuerKind == v1.ClusterIssuerKind {
+		issuer = &v1.ClusterIssuer{}
+	} else if issuerKind == v1.IssuerKind || issuerKind == "" {
+		issuer = &v1.Issuer{}
+		issuerNamespace = tlsPolicy.Namespace
+	} else {
+		return fmt.Errorf("issuer kind not supported: %s. Must be either ClusterIssuer or Issuer", issuerKind)
+	}
+
+	err = r.Client().Get(ctx, client.ObjectKey{Name: issuerName, Namespace: issuerNamespace}, issuer)
+	if err != nil {
+		return err
+	}
+
 	// reconcile based on gateway diffs
 	gatewayDiffObj, err := r.ComputeGatewayDiffs(ctx, tlsPolicy, targetNetworkObject, &TLSPolicyRefsConfig{})
 	if err != nil {