`NautobotSecretRef` is optional in CRD, reconciler fails when it is unset

[geetikabatra]

NautobotSpec.NautobotSecretRef has no +kubebuilder:validation:Required or +kubebuilder:default marker in nautobot_types.go. This means the Kubernetes API server accepts a Nautobot CR with no nautobotSecretRef set at all.

However, Reconcile → getAuthTokenFromSecretRef assumes it’s always populated and hard-fails with:

failed to get nautobot auth token {"error": "nautobotSecretRef \"\" is missing a namespace"}

Expected behavior

• If nautobotSecretRef.Name is empty, the reconciler should skip gracefully: update .Status.Ready = false and .Status.Message with a clear “not configured” message, then requeue — instead of returning a raw error.

• If nautobotSecretRef.Namespace is empty but .Name is set, default to the CR’s own namespace rather than failing.

This issue first appeared in make test. Looks like it appears for the resource type "Prefix"

Raw logs

2026-08-03T16:21:31+05:30     INFO    resource needs sync     {"resource": "cluster", "reason": "data changed"}
  2026-08-03T16:21:31+05:30     INFO    resource needs sync     {"resource": "prefix", "reason": "data changed"}
  2026-08-03T16:21:31+05:30     ERROR   failed to get nautobot auth token       {"error": "nautobotSecretRef \"\" is missing a namespace"}
  github.com/rackerlabs/understack/go/nautobotop/internal/controller.(*NautobotReconciler).Reconcile
        /Users/geetika.batra/understack/go/nautobotop/internal/controller/nautobot_controller.go:183
  github.com/rackerlabs/understack/go/nautobotop/internal/controller.init.func1.1.2
        /Users/geetika.batra/understack/go/nautobotop/internal/controller/nautobot_controller_test.go:77
  github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3
        /Users/geetika.batra/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.22.0/internal/node.go:475
  github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3
        /Users/geetika.batra/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.22.0/internal/suite.go:894
  [FAILED] in [It] - /Users/geetika.batra/understack/go/nautobotop/internal/controller/nautobot_controller_test.go:80 @ 08/03/26 16:21:31.434
  << Timeline

  [FAILED] Unexpected error:
      <*errors.errorString | 0x498001636b40>: 
      nautobotSecretRef "" is missing a namespace
      {
          s: "nautobotSecretRef \"\" is missing a namespace",
      }
  occurred
  In [It] at: /Users/geetika.batra/understack/go/nautobotop/internal/controller/nautobot_controller_test.go:80 @ 08/03/26 16:21:31.434
------------------------------

Summarizing 1 Failure:
  [FAIL] Nautobot Controller When reconciling a resource [It] should successfully reconcile the resource
  /Users/geetika.batra/understack/go/nautobotop/internal/controller/nautobot_controller_test.go:80

Ran 1 of 1 Specs in 6.040 seconds
FAIL! -- 0 Passed | 1 Failed | 0 Pending | 0 Skipped
--- FAIL: TestControllers (6.04s)