nic-6443 commented on code in PR #2810:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2810#discussion_r3656006073
##########
internal/webhook/v1/ssl/conflict_detector.go:
##########
@@ -92,22 +98,23 @@ func (d *ConflictDetector) DetectConflicts(ctx
context.Context, obj client.Objec
conflicts := make([]SSLConflict, 0)
// First, check for conflicts within the new resource itself.
- seen := make(map[string]string, len(newMappings))
+ seen := make(map[string]HostCertMapping, len(newMappings))
for _, mapping := range newMappings {
if mapping.Host == "" || mapping.CertificateHash == "" {
continue
Review Comment:
This remains valid on the current head: `seen[mapping.Host]` still compares
exact strings, while the external path uses `HostsOverlap`. A single object can
therefore admit `*.example.com` and `app.example.com` with different
certificate or client config. Please make the intra-resource check
overlap-aware and add coverage for both Ingress TLS blocks and Gateway
listeners.
##########
internal/webhook/v1/ssl/conflict_detector.go:
##########
@@ -376,8 +433,12 @@ func (d *ConflictDetector) findExternalConflicts(ctx
context.Context, obj client
if !ok {
continue
}
- // same cert hash, no conflict
- if mapping.CertificateHash == hosts[host] {
+ // Same server cert AND same mTLS client config: no
conflict. A
+ // differing client config is still a conflict even
when the server
+ // cert matches.
+ newMapping := newMappings[host]
+ if mapping.CertificateHash ==
newMapping.CertificateHash &&
Review Comment:
This also remains on the current head. `ClientConfigHash` can be the only
differing field, but `SSLConflict` carries no cause and `FormatConflicts`
always reports a “different certificate”. Please report a generic differing TLS
configuration, or carry the differing field into the diagnostic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
