kayx23 commented on issue #2851:
URL: 
https://github.com/apache/apisix-ingress-controller/issues/2851#issuecomment-5425695525

   Yes, this is supported starting in APISIX Ingress Controller 2.1.0. 
`secretRef` belongs next to `config`, not inside it. 
`ApisixConsumer.spec.plugins` uses the [`ApisixRoutePlugin` 
shape](https://docs.api7.ai/ingress-controller/reference/crd-reference#apisixrouteplugin),
 which defines `config` and `secretRef` as separate fields. The docs also show 
the [consumer-scoped plugin 
structure](https://docs.api7.ai/ingress-controller/reference/examples#configure-plugin-on-consumer).
   
   For example, have the `ExternalSecret` create a Secret in the same namespace 
as the `ApisixConsumer`:
   
   ```yaml
   apiVersion: v1
   kind: Secret
   metadata:
     name: test-forgerock
     namespace: aic
   type: Opaque
   stringData:
     client_id: test-client
     client_secret: test-secret
   ---
   apiVersion: apisix.apache.org/v2
   kind: ApisixConsumer
   metadata:
     name: test
     namespace: aic
   spec:
     ingressClassName: apisix
     authParameter:
       jwtAuth:
         secretRef:
           name: test-jwt
     plugins:
       - name: vendor-forgerock
         enable: true
         config:
           username: test
         secretRef: test-forgerock
   ```
   
   The controller merges keys from the referenced Kubernetes Secret into that 
plugin's configuration. Here, the custom plugin receives `username`, 
`client_id`, and `client_secret` as its normal configuration fields. If a key 
exists in both places, the Secret value wins. Putting `secretRef` inside 
`config` instead makes APISIX validate `secretRef` as part of the custom plugin 
configuration and can produce the schema error you saw.
   
   Two security and compatibility details:
   
   - This is reconciliation-time injection: the Ingress Controller reads the 
Kubernetes Secret and sends the resolved values in the generated consumer 
configuration. The Lua plugin does not read the Kubernetes Secret or Vault 
directly at request time. Secret updates do trigger reconciliation.
   - The custom plugin's consumer schema must accept `username`, `client_id`, 
and `client_secret`. If you also require at-rest protection after the 
controller sends the resolved value to APISIX, declare `client_secret` in that 
schema's `encrypt_fields` and configure [APISIX data 
encryption](https://docs.api7.ai/apisix/production/security/data-encryption-with-keyring).
   
   APISIX 3.17 does not identify the Ingress Controller version. If this shape 
still fails, please share the controller version and the custom plugin's 
consumer schema; `spec.plugins` support for `ApisixConsumer` first shipped in 
Ingress Controller 2.1.0.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to