🐛 Add server-cert Secret validation and clarify namespace in TLS docs

- Add lookup/fail guard for server-cert Secret in superlink.yaml to fail
  fast when the Secret is missing (mirrors existing CA Secret validation)
- Update TLS docs to clarify namespace assumptions and guide users to pass
  matching --namespace when overriding superlink.namespace

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Meng Yan <myan@redhat.com>

Author: yanmxa

flower-addon/charts/flower-addon/templates/superlink.yaml

@@ -1,4 +1,10 @@
 {{- if .Values.superlink.enabled }}
+{{- if .Values.tls.enabled }}
+{{- $serverSecret := (lookup "v1" "Secret" .Values.superlink.namespace .Values.tls.serverCert.secretName) }}
+{{- if not $serverSecret }}
+{{- fail (printf "TLS enabled but Secret '%s/%s' not found. Run hack/generate-certs.sh first." .Values.superlink.namespace .Values.tls.serverCert.secretName) }}
+{{- end }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

flower-addon/docs/enable-tls.md

@@ -16,8 +16,13 @@ cd flower-addon
 ./hack/generate-certs.sh --hub-ip <HUB_NODE_IP>
 ```
 
-This creates two Kubernetes Secrets in `flower-system`:
-- `flower-tls-ca` — CA certificate and key
+This creates two Kubernetes Secrets in `flower-system` (default namespace). If you override `superlink.namespace` in Helm values, pass the same namespace here:
+
+```bash
+./hack/generate-certs.sh --hub-ip <HUB_NODE_IP> --namespace <YOUR_NAMESPACE>
+```
+
+- `flower-tls-ca` — CA certificate and key (used to verify server identity)
 - `flower-superlink-tls` — SuperLink server certificate, key, and CA cert
 
 The server certificate SANs include:
@@ -51,6 +56,7 @@ root-certificates = "/path/to/ca.crt"
 Extract the CA cert from the cluster:
 
 ```bash
+# Use the same namespace as your SuperLink deployment (default: flower-system)
 kubectl get secret flower-tls-ca -n flower-system -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
 ```