shreemaan-abhishek opened a new pull request, #2824: URL: https://github.com/apache/apisix-ingress-controller/pull/2824
Follow-up to #2809, which was merged with three review points still open. ### 1. `signed_headers` delimiter was an undocumented convention #2809 made the Secret path split `signed_headers` on commas. As raised in review, that left a silent footgun: a newline- or space-separated value collapses into a single bogus header name, failing exactly as quietly as the byte-split bug that PR fixed. Rather than only documenting the comma convention, this accepts commas **and** whitespace as separators. Header field-names are RFC 7230 tokens, so they can never legitimately contain a comma, space, tab or newline. Splitting on all of them is lossless, cannot mis-split a valid header name, and removes the failure class instead of signposting it. Comma remains the canonical form in the docs. ### 2. Documented the Secret-vs-Value format difference The two paths necessarily differ (a Secret value is an opaque string, `Value` takes a native `[]string`). That is now stated on the `ApisixConsumerHMACAuth.SecretRef` field, with the CRD and API reference regenerated. ### 3. Applied a review suggestion that was marked resolved but never landed The `hmacConsumerWithSecret` helper parameter was still named `name` despite being the SecretRef name; renamed to `secretName`. ### Tests - `signed_headers` table now covers comma, newline, space, padding/empty entries, single-header and empty input. - Adds the previously missing `max_req_body` parse-failure case, and asserts the error names the offending Secret (`default/hmac`) — behavior added in #2809 but never covered by a test. ### Behavior-change note for the changelog Also flagged in the #2809 review and worth restating here: since #2809, a consumer whose Secret carries an unparseable `clock_skew` or `max_req_body` now **fails translation and stops syncing**, where it previously defaulted silently and synced. The failure is self-scoped to that consumer. Empty/absent values still take the default path. Paired enterprise change: api7/api7-ingress-controller#436. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
