This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch feat/gateway-api-1.6.0
in repository https://gitbox.apache.org/repos/asf/apisix-ingress-controller.git
The following commit(s) were added to refs/heads/feat/gateway-api-1.6.0 by this
push:
new 3a19574a fix: address review feedback on Gateway API 1.6 changes
3a19574a is described below
commit 3a19574a8a86801fe4a6f022f28ca5359926a6ff
Author: AlinsRan <[email protected]>
AuthorDate: Thu Jul 23 08:53:07 2026 +0800
fix: address review feedback on Gateway API 1.6 changes
- consumer webhook: drop the key-auth credential value from the
duplicate-key
error so secret material is not leaked to API clients and logs.
- gateway status: reuse a previous listener status only when the listener
name
also matches, so reordered spec.listeners cannot publish another
listener's
status under the wrong name.
- KindOf: return ReferenceGrant for *gatewayv1beta1.ReferenceGrant so
GvkOf(&ReferenceGrant{}) no longer yields kind Unknown.
- frontendValidation: resolve downstream mTLS only for TLS-terminating
listeners
(HTTPS/TLS), never for plaintext listeners.
---
internal/adc/translator/gateway.go | 5 +++++
internal/adc/translator/gateway_test.go | 1 +
internal/controller/gateway_controller.go | 5 +++++
internal/controller/utils.go | 6 ++++++
internal/types/k8s.go | 3 +++
internal/webhook/v1/consumer_webhook.go | 4 +++-
internal/webhook/v1/consumer_webhook_test.go | 4 +++-
7 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/internal/adc/translator/gateway.go
b/internal/adc/translator/gateway.go
index 7df96b48..2ec64946 100644
--- a/internal/adc/translator/gateway.go
+++ b/internal/adc/translator/gateway.go
@@ -159,6 +159,11 @@ func (t *Translator) translateSecret(tctx
*provider.TranslateContext, listener g
// spec.tls.frontend: Default applies to all HTTPS listeners, and a PerPort
entry
// overrides it for listeners on the matching port.
func frontendTLSValidation(obj *gatewayv1.Gateway, listener
gatewayv1.Listener) *gatewayv1.FrontendTLSValidation {
+ // Downstream mTLS only applies where the Gateway terminates TLS
(HTTPS/TLS
+ // listeners); never enable client-cert validation on plaintext
listeners.
+ if listener.Protocol != gatewayv1.HTTPSProtocolType &&
listener.Protocol != gatewayv1.TLSProtocolType {
+ return nil
+ }
if obj.Spec.TLS == nil || obj.Spec.TLS.Frontend == nil {
return nil
}
diff --git a/internal/adc/translator/gateway_test.go
b/internal/adc/translator/gateway_test.go
index 225cd2fd..ec1d7ee0 100644
--- a/internal/adc/translator/gateway_test.go
+++ b/internal/adc/translator/gateway_test.go
@@ -61,6 +61,7 @@ func newTLSGateway(frontendValidation
*gatewayv1.FrontendTLSValidation) *gateway
Listeners: []gatewayv1.Listener{
{
Name: "https",
+ Protocol: gatewayv1.HTTPSProtocolType,
Hostname:
ptr.To(gatewayv1.Hostname("example.com")),
TLS: &gatewayv1.ListenerTLSConfig{
Mode:
ptr.To(gatewayv1.TLSModeTerminate),
diff --git a/internal/controller/gateway_controller.go
b/internal/controller/gateway_controller.go
index 4c6f971a..f1a4135d 100644
--- a/internal/controller/gateway_controller.go
+++ b/internal/controller/gateway_controller.go
@@ -476,6 +476,11 @@ func (r *GatewayReconciler) processInfrastructure(tctx
*provider.TranslateContex
// validation (Gateway API v1.6 spec.tls.frontend) that applies to the given
HTTPS
// listener: a PerPort entry matching the listener's port overrides the
Default.
func frontendTLSValidationForListener(gateway *gatewayv1.Gateway, listener
gatewayv1.Listener) *gatewayv1.FrontendTLSValidation {
+ // Downstream mTLS only applies where the Gateway terminates TLS
(HTTPS/TLS
+ // listeners); never enable client-cert validation on plaintext
listeners.
+ if listener.Protocol != gatewayv1.HTTPSProtocolType &&
listener.Protocol != gatewayv1.TLSProtocolType {
+ return nil
+ }
if gateway.Spec.TLS == nil || gateway.Spec.TLS.Frontend == nil {
return nil
}
diff --git a/internal/controller/utils.go b/internal/controller/utils.go
index 6001534d..4ac80679 100644
--- a/internal/controller/utils.go
+++ b/internal/controller/utils.go
@@ -1035,6 +1035,12 @@ func getListenerStatus(
changed := false
if len(gateway.Status.Listeners) > i {
+ // Listener status is keyed by name, not position: if
the spec listeners
+ // were reordered, index i now points at a different
listener, so it must
+ // not be reused for this one.
+ if gateway.Status.Listeners[i].Name != listener.Name {
+ changed = true
+ }
if gateway.Status.Listeners[i].AttachedRoutes !=
attachedRoutes {
changed = true
}
diff --git a/internal/types/k8s.go b/internal/types/k8s.go
index dfe6a2de..42b2ea7a 100644
--- a/internal/types/k8s.go
+++ b/internal/types/k8s.go
@@ -43,6 +43,7 @@ const (
KindGRPCRoute = "GRPCRoute"
KindTLSRoute = "TLSRoute"
KindGatewayClass = "GatewayClass"
+ KindReferenceGrant = "ReferenceGrant"
KindIngress = "Ingress"
KindIngressClass = "IngressClass"
KindGatewayProxy = "GatewayProxy"
@@ -86,6 +87,8 @@ func KindOf(obj any) string {
return KindTLSRoute
case *gatewayv1.GatewayClass:
return KindGatewayClass
+ case *gatewayv1beta1.ReferenceGrant:
+ return KindReferenceGrant
case *netv1.Ingress:
return KindIngress
case *netv1.IngressClass:
diff --git a/internal/webhook/v1/consumer_webhook.go
b/internal/webhook/v1/consumer_webhook.go
index d511a5ea..a19b5782 100644
--- a/internal/webhook/v1/consumer_webhook.go
+++ b/internal/webhook/v1/consumer_webhook.go
@@ -174,7 +174,9 @@ func (v *ConsumerCustomValidator)
validateDuplicateKeyAuthCredentials(ctx contex
}
for key := range existingKeys {
if _, ok := keys[key]; ok {
- return fmt.Errorf("duplicate key-auth
credential key %q already used by Consumer %s/%s", key, existing.Namespace,
existing.Name)
+ // Do not include the credential value in the
error: it is returned to
+ // API clients and logged, which would leak the
secret key material.
+ return fmt.Errorf("duplicate key-auth
credential already used by Consumer %s/%s", existing.Namespace, existing.Name)
}
}
}
diff --git a/internal/webhook/v1/consumer_webhook_test.go
b/internal/webhook/v1/consumer_webhook_test.go
index 4dc32b84..1ea36d66 100644
--- a/internal/webhook/v1/consumer_webhook_test.go
+++ b/internal/webhook/v1/consumer_webhook_test.go
@@ -189,6 +189,8 @@ func TestConsumerValidator_DenyDuplicateKeyAuthCredential(t
*testing.T) {
warnings, err := validator.ValidateCreate(context.Background(),
consumer)
require.Empty(t, warnings)
require.Error(t, err)
- require.Contains(t, err.Error(), `duplicate key-auth credential key
"shared-key"`)
+ require.Contains(t, err.Error(), "duplicate key-auth credential")
require.Contains(t, err.Error(), "default/existing")
+ // The credential value must never leak into the error returned to
clients/logs.
+ require.NotContains(t, err.Error(), "shared-key")
}
