CM-1038: Replace istiocsr type-specific decoders with generic DecodeObjBytes - #418

In response to this:

Summary

• Remove 8 type-specific decode*ObjBytes functions from the istiocsr package (~95 lines) and replace all 22 call sites with the existing generic common.DecodeObjBytes[T] helper
• Cache the ServiceAccount name at init time to avoid redundant YAML deserialization on every reconcile cycle
• Aligns the istiocsr package with the pattern already used by the trustmanager package

Test plan

• Unit tests pass (go test ./pkg/controller/istiocsr/...)
• Build succeeds (go build ./pkg/controller/istiocsr/)
• No new lint issues introduced
• CI checks pass

Jira: https://redhat.atlassian.net/browse/CM-1038

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Pre-merge checks: 14

Check name	Status	Explanation
Title check		The title accurately summarizes the main change: replacing istiocsr-specific decoders with the generic DecodeObjBytes helper.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		PASS: No Ginkgo titles exist in pkg/controller/istiocsr tests, and no computed subtest names were found; existing names are static string literals.
Test Structure And Quality		No Ginkgo specs were added or changed in the touched package; tests are table-driven testing.T fakes with no cluster waits or cleanup issues.
Microshift Test Compatibility		The PR only refactors istiocsr unit-test helpers and controller code; no new Ginkgo e2e specs or MicroShift-unsupported APIs/features were added.
Single Node Openshift (Sno) Test Compatibility		No new Ginkgo/e2e specs were added; the PR only changes controller code and standard Go unit-test helpers, with no multi-node assumptions or SNO skips needed.
Topology-Aware Scheduling Compatibility		Only object-decoding helpers changed; deployment/affinity/nodeSelector/replica logic and embedded manifests are unchanged, so no topology-sensitive scheduling was introduced.
Ote Binary Stdout Contract		No stdout writes were added in init/setup code; the new init() only caches the ServiceAccount name via DecodeObjBytes, and searches found no fmt/log/klog stdout use in touched files.
Ipv6 And Disconnected Network Test Compatibility		PASS: The PR only changes unit-test helpers and standard t.Run tests; no new Ginkgo/e2e tests, IPv4-only parsing, or external/public connectivity were added.
No-Weak-Crypto		Touched files contain no weak-crypto APIs or secret comparisons; only standard x509/rand/rsa usage appears in tests and cert handling.
Container-Privileges		Changed files only swap decoders; no privileged fields are added. The istio-csr deployment manifest uses allowPrivilegeEscalation:false, runAsNonRoot:true, and drops ALL caps.
No-Sensitive-Data-In-Logs		PASS: The PR only swaps decoders/caches a SA name; touched log calls emit generic resource/namespace identifiers and no secrets, tokens, PII, or hostnames.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

🧪 Generate unit tests (beta)

• Create PR with unit tests

In response to this:

Summary

• Remove 8 type-specific decode*ObjBytes functions from the istiocsr package (~95 lines) and replace all 22 call sites with the existing generic common.DecodeObjBytes[T] helper, reducing net code by 35 lines
• Decode the istio-csr ServiceAccount name inline in rbacs.go with the generic helper (per review, no package-level cache)
• Aligns the istiocsr package with the pattern established by the trustmanager package in CM-867: Implement trust-manager resource reconcilers #379
• Add direct unit tests for DecodeObjBytes covering successful decode, panic on invalid bytes, and panic on type mismatch
• Add test coverage for EffectiveSpec nil-Custom error path (pkg/tlsprofile)

Jira

• CM-1038 -- Replace istiocsr type-specific decoders with generic DecodeObjBytes (Code Review)

Test Plan

• Unit tests pass (go test ./pkg/controller/istiocsr/...)
• New DecodeObjBytes unit tests pass (go test ./pkg/controller/common/...)
• New EffectiveSpec nil-Custom test passes (go test ./pkg/tlsprofile/...)
• Build succeeds (go build ./pkg/controller/istiocsr/)
• No new lint issues introduced
• CI checks pass

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

• OWNERS [bharath-b-rh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@@            Coverage Diff             @@
##           master     #418      +/-   ##
==========================================
- Coverage   34.53%   32.75%   -1.78%     
==========================================
  Files         119      119              
  Lines        9014     8950      -64     
==========================================
- Hits         3113     2932     -181     
- Misses       5503     5597      +94     
- Partials      398      421      +23     

Flags with carried forward coverage won't be shown. Click here to find out more.

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.