From d9e7c058c160a2c1236980f89e53db25ed10a2bc Mon Sep 17 00:00:00 2001
From: Nicolas Karolak <nicolas@karolak.fr>
Date: Tue, 24 Mar 2026 17:47:48 +0100
Subject: [PATCH] fix(ingress-controller): use webhook secret name from values
 when provided

The webhook.certificate.secretName value in values.yaml was being ignored.
The deployment always used the helper-generated name regardless of user input.

This fix modifies the webhook.secretName helper to:
- Check if webhook.certificate.provided is true AND secretName is set
- Use the user-provided secret name when both conditions are met
- Fall back to the generated default otherwise

Fixes #954
---
 charts/apisix-ingress-controller/templates/_helpers.tpl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/charts/apisix-ingress-controller/templates/_helpers.tpl b/charts/apisix-ingress-controller/templates/_helpers.tpl
index cf34bd71..08667a7a 100644
--- a/charts/apisix-ingress-controller/templates/_helpers.tpl
+++ b/charts/apisix-ingress-controller/templates/_helpers.tpl
@@ -79,11 +79,15 @@ Webhook service name - ensure it stays within 63 character limit
 {{- end }}
 
 {{/*
-Webhook secret name - ensure it stays within 63 character limit
+Webhook secret name - use value from values.yaml if provided, otherwise generate one
 */}}
 {{- define "apisix-ingress-controller-manager.webhook.secretName" -}}
+{{- if and .Values.webhook.certificate.provided .Values.webhook.certificate.secretName -}}
+{{- .Values.webhook.certificate.secretName -}}
+{{- else -}}
 {{- $suffix := "-webhook-cert" -}}
 {{- $maxLen := sub 63 (len $suffix) | int -}}
 {{- $baseName := include "apisix-ingress-controller-manager.name.fullname" . | trunc $maxLen | trimSuffix "-" -}}
 {{- printf "%s%s" $baseName $suffix -}}
+{{- end -}}
 {{- end }}