From 2844fcf9b0467bb00cc9af56db59edd7a9dc65b5 Mon Sep 17 00:00:00 2001
From: parth-gr <partharora1010@gmail.com>
Date: Mon, 18 Aug 2025 15:31:39 +0530
Subject: [PATCH] csi: fix the prior key count for csi key rotation

fix the prior key count status for the csi
key rotation

Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 7b5d4768879fc8053e804826f4b572a1f1941ca5)
---
 pkg/operator/ceph/csi/secrets.go      |  9 ++++++++-
 pkg/operator/ceph/csi/secrets_test.go | 19 +++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/pkg/operator/ceph/csi/secrets.go b/pkg/operator/ceph/csi/secrets.go
index dec6faf71..7a023770f 100644
--- a/pkg/operator/ceph/csi/secrets.go
+++ b/pkg/operator/ceph/csi/secrets.go
@@ -120,6 +120,9 @@ func createCSIKeyring(
 	allKeyWithBaseName = deduplicate(allKeyWithBaseName)
 
 	currentKeyCount := len(allKeyWithBaseName) - len(keysDeleted)
+	if currentKeyCount <= 0 {
+		logger.Warningf("currentKeyCount is %d is less than or equal to 0; this could be due to an error in key generation", currentKeyCount)
+	}
 
 	return latestClientId, key, currentKeyCount, shouldRotate, nil
 }
@@ -314,7 +317,7 @@ func updateCephStatusWithCephxStatus(context *clusterd.Context, clusterInfo *cli
 			return errors.Wrapf(err, "failed to retrieve cephCluster %q to update CSICephxStatus", namespacedName.Namespace)
 		}
 		cephCluster.Status.Cephx.CSI.CephxStatus = cephxStatus
-		cephCluster.Status.Cephx.CSI.PriorKeyCount = uint8(currentKeyCount) //nolint:gosec // disable G115
+		cephCluster.Status.Cephx.CSI.PriorKeyCount = uint8(getPriorKeyCount(currentKeyCount)) //nolint:gosec // disable G115
 
 		if err := reporting.UpdateStatus(context.Client, cephCluster); err != nil {
 			return errors.Wrapf(err, "failed to update cephCluster %q to update csi cephx status to %q in namespace %q", namespacedName.Name, cephxStatus, namespacedName.Namespace)
@@ -329,6 +332,10 @@ func updateCephStatusWithCephxStatus(context *clusterd.Context, clusterInfo *cli
 	return nil
 }
 
+func getPriorKeyCount(currentKeyCount int) int {
+	return max(0, currentKeyCount-1)
+}
+
 // getCsiKeyRotationInfo runs the `ceph auth ls` command to fetch all the keys and filter out the keys with same base name. Example
 // for base name `client.csi-rbd-node`.
 // From the list of key name return from `getMatchingClient` we'll read the suffix index eg; for key `client.csi-rbd-node.3` we'll take `3` and compare with
diff --git a/pkg/operator/ceph/csi/secrets_test.go b/pkg/operator/ceph/csi/secrets_test.go
index d2893bd22..ebfe71910 100644
--- a/pkg/operator/ceph/csi/secrets_test.go
+++ b/pkg/operator/ceph/csi/secrets_test.go
@@ -522,3 +522,22 @@ func TestParseCsiClient(t *testing.T) {
 		})
 	}
 }
+
+func TestGetPriorKeyCount(t *testing.T) {
+	tests := []struct {
+		name     string
+		keyCount int
+		want     int
+	}{
+		{"keyGen 0", 0, 0},
+		{"keyGen 1", 1, 0},
+		{"keyGen 2", 2, 1},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := getPriorKeyCount(tt.keyCount)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}