AlinsRan opened a new pull request, #2855:
URL: https://github.com/apache/apisix-ingress-controller/pull/2855
### Description
Fixes #2832
Plugins configured through `apisix.apache.org/v1alpha1` resources had no way
to take part of their configuration from a Secret, so credentials such as the
`openid-connect` client secret had to be written in plain text in
`spec.config`. `ApisixPluginConfig` already supports `secretRef`, which left no
equivalent for users on the Gateway API, since `HTTPRoute` filters can only
reference `PluginConfig`.
This adds `secretRef` to the shared v1alpha1 `Plugin` type, so it works in
`PluginConfig`, `Consumer` and `L4RoutePolicy`:
```yaml
apiVersion: v1
kind: Secret
metadata:
name: oidc-credentials
stringData:
client_id: my-client
client_secret: "s3cr3t"
session.secret: "8f2a..."
---
apiVersion: apisix.apache.org/v1alpha1
kind: PluginConfig
metadata:
name: oidc
spec:
plugins:
- name: openid-connect
secretRef:
name: oidc-credentials
config:
discovery: https://idp.example.com/.well-known/openid-configuration
scope: openid profile
```
Behaviour:
- The Secret data is merged over `spec.config`. Each key is read as a dot
separated path, so `session.secret` sets the `secret` field of the `session`
object. This matches how `ApisixPluginConfig` already handles `secretRef`.
- Values are merged as strings, so numeric and boolean fields stay in
`config`.
- The Secret must be in the namespace of the object that declares the plugin.
- A plugin whose Secret is missing is not programmed with a partial
configuration. The referencing route or consumer reports the failure in its
status.
- Secrets are indexed and watched by the HTTPRoute, GRPCRoute, TCPRoute,
UDPRoute, TLSRoute and Consumer controllers, so updating a Secret reprograms
the plugins that read it.
I chose this over making `ApisixPluginConfig` usable from an `ExtensionRef`,
because referencing `ApisixPluginConfig` from an `HTTPRoute` has an ownership
problem: `ApisixPluginConfig` has `spec.ingressClassName` and is reconciled
against it, while `PluginConfig` has no class field and inherits its owner from
the route's Gateway and that Gateway's `GatewayClass`. An `HTTPRoute` on
GatewayClass `a` referencing an `ApisixPluginConfig` with `ingressClassName: b`
would leave a choice between ignoring `ingressClassName` and reporting
`ResolvedRefs=False` on an object that exists and is owned by another
controller.
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
