fix: return error when operator namespace cannot be resolved

Return an error instead of silently returning nil when
infrastructure.GetNamespace() fails on the restore path. This makes
auth failures visible immediately rather than causing a confusing
image pull error later.

Also properly save and restore the WATCH_NAMESPACE env var in tests.

Assisted-by: Claude Code

Signed-off-by: Oleksii Kurinnyi <okurynny@redhat.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

Author: akurinnoy

pkg/secrets/backup.go

@@ -63,8 +63,7 @@ func HandleRegistryAuthSecret(ctx context.Context, c client.Client, workspace *d
 	if operatorConfigNamespace == "" {
 		resolvedNS, nsErr := infrastructure.GetNamespace()
 		if nsErr != nil {
-			log.Info("Cannot resolve operator namespace for auth secret fallback", "error", nsErr)
-			return nil, nil
+			return nil, fmt.Errorf("cannot resolve operator namespace to copy registry auth secret: %w", nsErr)
 		}
 		operatorConfigNamespace = resolvedNS
 	}

pkg/secrets/backup_test.go

@@ -117,14 +117,15 @@ var _ = Describe("HandleRegistryAuthSecret (restore path: operatorConfigNamespac
 		Expect(result.Name).To(Equal(constants.DevWorkspaceBackupAuthSecretName))
 	})
 
-	It("returns nil when the predefined secret does not exist in the workspace namespace", func() {
-		By("using a fake client with no secrets")
+	It("returns error when secret is missing and operator namespace cannot be resolved", func() {
+		By("using a fake client with no secrets and no WATCH_NAMESPACE set")
 		fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
 		workspace := makeWorkspace(workspaceNS)
 		config := makeConfig("quay-backup-auth")
 
 		result, err := secrets.HandleRegistryAuthSecret(ctx, fakeClient, workspace, config, "", scheme, log)
-		Expect(err).NotTo(HaveOccurred())
+		Expect(err).To(HaveOccurred())
+		Expect(err.Error()).To(ContainSubstring("cannot resolve operator namespace"))
 		Expect(result).To(BeNil())
 	})
 
@@ -271,19 +272,26 @@ var _ = Describe("HandleRegistryAuthSecret (restore path: fallback to operator n
 	)
 
 	var (
-		ctx    context.Context
-		scheme *runtime.Scheme
-		log    = zap.New(zap.UseDevMode(true)).WithName("SecretsTest")
+		ctx         context.Context
+		scheme      *runtime.Scheme
+		log         = zap.New(zap.UseDevMode(true)).WithName("SecretsTest")
+		origWatchNS string
+		hadWatchNS  bool
 	)
 
 	BeforeEach(func() {
 		ctx = context.Background()
 		scheme = buildScheme()
+		origWatchNS, hadWatchNS = os.LookupEnv(infrastructure.WatchNamespaceEnvVar)
 		os.Setenv(infrastructure.WatchNamespaceEnvVar, operatorNS)
 	})
 
 	AfterEach(func() {
-		os.Unsetenv(infrastructure.WatchNamespaceEnvVar)
+		if hadWatchNS {
+			os.Setenv(infrastructure.WatchNamespaceEnvVar, origWatchNS)
+		} else {
+			os.Unsetenv(infrastructure.WatchNamespaceEnvVar)
+		}
 	})
 
 	It("copies the secret from operator namespace when missing in workspace namespace", func() {