ehncraft opened a new pull request, #2801:
URL: https://github.com/apache/apisix-ingress-controller/pull/2801
### Type of change:
- [x] Bugfix
### What this PR does / why we need it:
`translateSecret()` rejects any TLS listener with `nil` `CertificateRefs`
before it even checks `listener.TLS.Mode`, so any Gateway with a
`Passthrough`-mode listener fails translation with:
```
no certificateRefs found in listener <name>
```
and the Gateway's `Accepted` condition is permanently `False` — even though
`CertificateRefs` must be empty in `Passthrough` mode per the Gateway API spec
(TLS is never terminated at the Gateway, so there's no certificate for it to
present). The `switch` statement already has a case correctly documenting this:
```go
// Only supported on TLSRoute. The certificateRefs field is ignored in this
mode.
case gatewayv1.TLSModePassthrough:
return sslObjs, nil
```
but the guard above the switch makes that case unreachable.
This also isn't purely cosmetic: `TranslateGateway` returns early on this
error, so it never reaches the `GatewayProxy` global-rules/plugin-metadata
aggregation at the bottom of the function — meaning any cluster-wide
plugins/plugin-metadata configured via a `GatewayProxy` attached to a Gateway
with a Passthrough listener silently never get applied.
This PR moves the nil check into the `Terminate` case, the only mode that
actually needs a certificate.
### Pre-submission checklist:
- [x] Did you explain what problem does this PR solve? Or what new features
have been added?
- [x] Have you added corresponding test cases?
- [x] Have you modified the corresponding document?
- [x] Is this PR backward compatible? Yes — it only relaxes a
previously-unconditional error for a spec-valid input (`Passthrough` listener
with no `certificateRefs`). `Terminate`-mode behavior is unchanged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
