AlinsRan commented on code in PR #2810:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2810#discussion_r3662349160
##########
internal/webhook/v1/ssl/conflict_detector.go:
##########
@@ -251,17 +258,37 @@ func (d *ConflictDetector) BuildApisixTlsMappings(ctx
context.Context, tls *apiv
// if len(hosts) == 0 {
// hosts = info.hosts
// }
+ clientHash := clientConfigHash(tls.Spec.Client)
for _, host := range hosts {
mappings = append(mappings, HostCertMapping{
- Host: host,
- CertificateHash: info.hash,
- ResourceRef: fmt.Sprintf("%s/%s/%s",
internaltypes.KindApisixTls, tls.Namespace, tls.Name),
+ Host: host,
+ CertificateHash: info.hash,
+ ClientConfigHash: clientHash,
+ ResourceRef: fmt.Sprintf("%s/%s/%s",
internaltypes.KindApisixTls, tls.Namespace, tls.Name),
})
}
return mappings
}
+// clientConfigHash digests an ApisixTls mTLS client-verification config into a
+// stable key. Returns "" when no mTLS is configured, so a resource that
enforces
+// mTLS and one that doesn't produce different keys for the same host+cert. It
+// keys on the CA secret reference (namespace/name), which uniquely identifies
+// the trust anchor, plus depth and the skip regexes.
+func clientConfigHash(client *apiv2.ApisixMutualTlsClientConfig) string {
Review Comment:
Gateway listeners are missing here. `translateFrontendValidation` writes the
same `ssl.client` field from `listener.tls.frontendValidation`, but
`BuildGatewayMappings` leaves `ClientConfigHash` empty. Two Gateways on the
same host and cert with different client CAs still pass, and any Gateway
compared against an ApisixTls looks like "no mTLS".
Related: `FormatConflicts` always reports "is already configured with a
different certificate", which is misleading when the certificates are identical
and only the mTLS config differs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
