shreemaan-abhishek commented on code in PR #2806:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2806#discussion_r3656473858
##########
internal/controller/utils.go:
##########
@@ -1353,6 +1353,25 @@ func checkReferenceGrant(ctx context.Context, cli
client.Client, obj v1beta1.Ref
return false
}
+// CheckConsumerSecretRef reports whether a Consumer in fromNamespace may
reference
+// the Secret at secretNN, honoring ReferenceGrant for cross-namespace
references.
+func CheckConsumerSecretRef(ctx context.Context, cli client.Client,
fromNamespace string, secretNN k8stypes.NamespacedName) bool {
+ secretNS := secretNN.Namespace
+ return checkReferenceGrant(ctx, cli,
Review Comment:
Agreed. Fixed in d1dc6428: `CheckConsumerSecretRef` now returns `(bool,
error)` and propagates the `List` error instead of collapsing it to `false`.
Callers handle the three states distinctly:
- webhook warning path: on error, skip the Secret probe and emit a neutral
`Could not verify authorization for referenced Secret '<ns>/<name>'` warning
(no "without a ReferenceGrant" claim); on `false`, the existing grant-missing
warning.
- duplicate-key path (`extractCredentialKey`): on error, return it so
admission fails closed rather than admitting with a false warning.
- reconciler `processSpec`: on error, return it (reconcile retries) instead
of permanently denying.
Added `TestConsumerValidator_CrossNamespaceSecretGrantLookupError` (injects
a ReferenceGrant `List` failure via interceptor) asserting the neutral warning
and that the Secret probe is skipped; verified it fails against the old
error-swallowing behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
