AlinsRan commented on code in PR #2809:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2809#discussion_r3643523102
##########
internal/adc/translator/apisixconsumer.go:
##########
@@ -307,15 +308,25 @@ func (t *Translator) translateConsumerHMACAuthPlugin(tctx
*provider.TranslateCon
}
clockSkewRaw := sec.Data["clock_skew"]
- clockSkew, _ := strconv.ParseInt(string(clockSkewRaw), 10, 64)
+ var clockSkew int64
+ if len(clockSkewRaw) > 0 {
+ var err error
+ clockSkew, err = strconv.ParseInt(string(clockSkewRaw), 10, 64)
+ if err != nil {
+ return nil, fmt.Errorf("hmac-auth: invalid clock_skew
%q in secret %s/%s: %w", string(clockSkewRaw), consumerNamespace,
cfg.SecretRef.Name, err)
+ }
+ }
if clockSkew < 0 {
clockSkew = _hmacAuthClockSkewDefaultValue
}
+ // comma-separated header names, not raw bytes
signedHeadersRaw := sec.Data["signed_headers"]
- signedHeaders := make([]string, 0, len(signedHeadersRaw))
- for _, b := range signedHeadersRaw {
- signedHeaders = append(signedHeaders, string(b))
+ var signedHeaders []string
+ for _, h := range strings.Split(string(signedHeadersRaw), ",") {
Review Comment:
New convention: the Secret path now needs comma-separated `signed_headers`,
while the inline `Value` path takes a native `[]string`. Undocumented — worth a
line in the CRD field doc, else newline/space-separated input silently yields
one wrong header.
##########
internal/adc/translator/apisixconsumer.go:
##########
@@ -307,15 +308,25 @@ func (t *Translator) translateConsumerHMACAuthPlugin(tctx
*provider.TranslateCon
}
clockSkewRaw := sec.Data["clock_skew"]
- clockSkew, _ := strconv.ParseInt(string(clockSkewRaw), 10, 64)
+ var clockSkew int64
+ if len(clockSkewRaw) > 0 {
+ var err error
+ clockSkew, err = strconv.ParseInt(string(clockSkewRaw), 10, 64)
+ if err != nil {
+ return nil, fmt.Errorf("hmac-auth: invalid clock_skew
%q in secret %s/%s: %w", string(clockSkewRaw), consumerNamespace,
cfg.SecretRef.Name, err)
Review Comment:
Semantics change for the changelog: a consumer with an unparseable
`clock_skew`/`max_req_body` used to default silently and sync; now it
hard-fails and stops syncing. Right direction, self-scoped to that consumer.
The `len(...) > 0` guard correctly keeps the empty case on the default path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
