kayx23 commented on issue #2851: URL: https://github.com/apache/apisix-ingress-controller/issues/2851#issuecomment-5425695525
Yes, this is supported starting in APISIX Ingress Controller 2.1.0. `secretRef` belongs next to `config`, not inside it. `ApisixConsumer.spec.plugins` uses the [`ApisixRoutePlugin` shape](https://docs.api7.ai/ingress-controller/reference/crd-reference#apisixrouteplugin), which defines `config` and `secretRef` as separate fields. The docs also show the [consumer-scoped plugin structure](https://docs.api7.ai/ingress-controller/reference/examples#configure-plugin-on-consumer). For example, have the `ExternalSecret` create a Secret in the same namespace as the `ApisixConsumer`: ```yaml apiVersion: v1 kind: Secret metadata: name: test-forgerock namespace: aic type: Opaque stringData: client_id: test-client client_secret: test-secret --- apiVersion: apisix.apache.org/v2 kind: ApisixConsumer metadata: name: test namespace: aic spec: ingressClassName: apisix authParameter: jwtAuth: secretRef: name: test-jwt plugins: - name: vendor-forgerock enable: true config: username: test secretRef: test-forgerock ``` The controller merges keys from the referenced Kubernetes Secret into that plugin's configuration. Here, the custom plugin receives `username`, `client_id`, and `client_secret` as its normal configuration fields. If a key exists in both places, the Secret value wins. Putting `secretRef` inside `config` instead makes APISIX validate `secretRef` as part of the custom plugin configuration and can produce the schema error you saw. Two security and compatibility details: - This is reconciliation-time injection: the Ingress Controller reads the Kubernetes Secret and sends the resolved values in the generated consumer configuration. The Lua plugin does not read the Kubernetes Secret or Vault directly at request time. Secret updates do trigger reconciliation. - The custom plugin's consumer schema must accept `username`, `client_id`, and `client_secret`. If you also require at-rest protection after the controller sends the resolved value to APISIX, declare `client_secret` in that schema's `encrypt_fields` and configure [APISIX data encryption](https://docs.api7.ai/apisix/production/security/data-encryption-with-keyring). APISIX 3.17 does not identify the Ingress Controller version. If this shape still fails, please share the controller version and the custom plugin's consumer schema; `spec.plugins` support for `ApisixConsumer` first shipped in Ingress Controller 2.1.0. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
