Partial OpenSearchCluster spec > security > tls results in controller validation error

[elimumford]

Creating an OpenSearchCluster resource with a partial spec:

apiVersion: opensearch.opster.io/v1
kind: OpenSearchCluster
metadata:
  name: test-opensearch
  namespace: default
spec:
  security:
    tls:
      http:
        secret:
          name: test-opensearch-http
...

Results in:

1.6522032290237098e+09  INFO    controller.opensearchcluster    Reconciling OpenSearchCluster   {"reconciler group": "opensearch.opster.io", "reconciler kind": "OpenSearchCluster", "name": "test-opensearch", "namespace": "default", "cluster": "default/test-opensearch"}
1.6522032290357742e+09  ERROR   controller.opensearchcluster    Not all secrets for http provided       {"reconciler group": "opensearch.opster.io", "reconciler kind": "OpenSearchCluster", "name": "test-opensearch", "namespace": "default", "error": "missing secret in spec"}
opensearch.opster.io/pkg/reconcilers.(*TLSReconciler).Reconcile
        /workspace/pkg/reconcilers/tls.go:70
opensearch.opster.io/controllers.(*OpenSearchClusterReconciler).reconcilePhaseRunning
        /workspace/controllers/opensearchController.go:326
opensearch.opster.io/controllers.(*OpenSearchClusterReconciler).Reconcile
        /workspace/controllers/opensearchController.go:141
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
        /go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:114
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227

If pass in a ~full spec (with expected defaults) it will error the same.

apiVersion: opensearch.opster.io/v1
kind: OpenSearchCluster
metadata:
  name: test-opensearch
  namespace: default
spec:
  security:
    tls:
      http:
        generate: false
        caSecret:
          name: test-opensearch-http
        secret:
          name: test-opensearch-http
      transport:
        generate: true
        perNode: true
...

Expected behavior would be that remaining defaults would populate on their own... the CRD documentation list most of the properties as optional and does not specify this level of cross dependency (all or none like behavior). Or that the logged error was more clear... since the "secret" is not missing...