Merge 555c5eb04d into de1a4c463c

internal/ingress/annotations/proxyssl/main.go

@@ -17,6 +17,7 @@ limitations under the License.
 package proxyssl
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 	"sort"
@@ -190,28 +191,28 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) {
 	config := &Config{}
 
 	proxysslsecret, err := parser.GetStringAnnotation(proxySSLSecretAnnotation, ing, p.annotationConfig.Annotations)
-	if err != nil {
+	if err != nil && !errors.Is(err, ing_errors.ErrMissingAnnotations) {
 		return &Config{}, err
-	}
+	} else if err == nil {
+		ns, _, err := k8s.ParseNameNS(proxysslsecret)
+		if err != nil {
+			return &Config{}, ing_errors.NewLocationDenied(err.Error())
+		}
 
-	ns, _, err := k8s.ParseNameNS(proxysslsecret)
+		secCfg := p.r.GetSecurityConfiguration()
-	if err != nil {
+		// We don't accept different namespaces for secrets.
-		return &Config{}, ing_errors.NewLocationDenied(err.Error())
+		if !secCfg.AllowCrossNamespaceResources && ns != ing.Namespace {
-	}
+			return &Config{}, ing_errors.NewLocationDenied("cross namespace secrets are not supported")
+		}
 
-	secCfg := p.r.GetSecurityConfiguration()
+		proxyCert, err := p.r.GetAuthCertificate(proxysslsecret)
-	// We don't accept different namespaces for secrets.
+		if err != nil {
-	if !secCfg.AllowCrossNamespaceResources && ns != ing.Namespace {
+			e := fmt.Errorf("error obtaining certificate: %w", err)
-		return &Config{}, ing_errors.NewLocationDenied("cross namespace secrets are not supported")
+			return &Config{}, ing_errors.LocationDeniedError{Reason: e}
+		}
+		config.AuthSSLCert = *proxyCert
 	}
 
-	proxyCert, err := p.r.GetAuthCertificate(proxysslsecret)
-	if err != nil {
-		e := fmt.Errorf("error obtaining certificate: %w", err)
-		return &Config{}, ing_errors.LocationDeniedError{Reason: e}
-	}
-	config.AuthSSLCert = *proxyCert
-
 	config.Ciphers, err = parser.GetStringAnnotation(proxySSLCiphersAnnotation, ing, p.annotationConfig.Annotations)
 	if err != nil {
 		if ing_errors.IsValidationError(err) {