AlinsRan commented on issue #2799:
URL:
https://github.com/apache/apisix-ingress-controller/issues/2799#issuecomment-5472381527
Consumer-scoped plugins aren't limited to the built-in auth plugins, so what
you want should already work. `spec.plugins` takes any plugin, and it has a
`secretRef` field for exactly this case.
The thing that's tripping you up is where `secretRef` goes: it sits next to
`config`, not inside it. Anything you put inside `config` is passed through to
the plugin as-is, which is why the schema rejected it.
```yaml
apiVersion: v1
kind: Secret
metadata:
name: forgerock-test
namespace: apisix-ns
stringData:
client_id: test-client
client_secret: test-secret
---
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
name: test
namespace: apisix-ns
spec:
ingressClassName: apisix
authParameter:
jwtAuth:
secretRef:
name: test-jwt
plugins:
- name: vendor-forgerock
enable: true
secretRef: forgerock-test # next to config, not inside it
config:
username: test
```
Each key in the Secret is merged into the plugin config, so
`vendor-forgerock` ends up receiving `username`, `client_id` and
`client_secret` together. With one Secret per consumer that scales to your 100+
case, and the Secret can come from ExternalSecret as you described.
A couple of things to be aware of. The Secret has to be in the same
namespace as the `ApisixConsumer`. Values are merged as strings, so if the
plugin expects a number or a boolean somewhere, that field needs to stay in
`config`. A key containing a dot will nest, so `session.secret` in the Secret
becomes `session: {secret: ...}` in the config. And if the Secret is missing or
the name is misspelled, the controller currently logs it but still publishes
the consumer without those keys, so it's worth checking the logs the first time
rather than assuming a silent success means it worked.
This landed in 2.1.0 via #2761, so you'll need to be on that or later.
One last note on the error you saw: `the input data should be an empty
table` comes from the JSON schema validator when a schema declares `required`
as an empty list, which makes it demand that the whole object be empty. If it
still turns up after moving `secretRef` out of `config`, the place to look is
the `consumer_schema` in your `vendor-forgerock` plugin.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
