Copilot commented on code in PR #2810:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2810#discussion_r3627940606
##########
internal/webhook/v1/ssl/conflict_detector.go:
##########
@@ -376,8 +433,12 @@ func (d *ConflictDetector) findExternalConflicts(ctx
context.Context, obj client
if !ok {
continue
}
- // same cert hash, no conflict
- if mapping.CertificateHash == hosts[host] {
+ // Same server cert AND same mTLS client config: no
conflict. A
+ // differing client config is still a conflict even
when the server
+ // cert matches.
+ newMapping := newMappings[host]
+ if mapping.CertificateHash ==
newMapping.CertificateHash &&
Review Comment:
Conflicts can now be triggered by differing mTLS client config even when the
server certificate matches, but the formatted webhook message still says the
host is configured with a “different certificate”. This is misleading for users
debugging admission failures; the message should mention mTLS client-config
differences (or more generally “different TLS configuration”).
##########
internal/webhook/v1/ssl/conflict_detector.go:
##########
@@ -92,22 +98,23 @@ func (d *ConflictDetector) DetectConflicts(ctx
context.Context, obj client.Objec
conflicts := make([]SSLConflict, 0)
// First, check for conflicts within the new resource itself.
- seen := make(map[string]string, len(newMappings))
+ seen := make(map[string]HostCertMapping, len(newMappings))
for _, mapping := range newMappings {
if mapping.Host == "" || mapping.CertificateHash == "" {
continue
Review Comment:
Self-conflict detection only compares identical host strings via
`seen[mapping.Host]`, so overlapping hosts within the same object (e.g.
"*.example.com" vs "app.example.com") with different cert/mTLS config will not
be reported as a conflict. This leaves a correctness gap for Ingress/Gateway
resources that can define multiple TLS entries/listeners.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
