shreemaan-abhishek opened a new pull request, #2900: URL: https://github.com/apache/apisix-ingress-controller/pull/2900
<!-- Please answer these questions before submitting a pull request --> ### Type of change: - [x] Bugfix ### What this PR does / why we need it: The Consumer webhook rejects a key-auth key that another Consumer on the same Gateway already uses, but only at admission. When a credential's `secretRef` points to a Secret that does not exist yet, the key is empty and the check skips it. Creating the Secret afterwards fires no Consumer webhook, and the reconciler published the key with no check, so two Consumers on one Gateway could end up sharing a key-auth key. This PR moves the check into the reconciler, which sees every change: - Before `Provider.Update`, the reconciler drops any key-auth credential whose key an older Consumer on the same Gateway publishes. "Older" is by creation time, with namespace/name as the tie-break, so exactly one Consumer keeps the key, matching the webhook's first-come behavior. The Consumer stays published with its other credentials, and its status reports `N key-auth credential(s) skipped: key already used by another Consumer`. - Keys are looked up through new field indexes on Consumers (inline keys) and Secrets (`data.key`). Index values are SHA-256 hashes of the key, so plaintext keys never land in the index. - A credential only counts as publishing a key when the controller would load it: a cross-namespace Secret without a permitting ReferenceGrant holds no key. - Consumer and Secret events requeue the Consumers that share the affected key, so a skipped credential is published again once the key is free (for example, the older Consumer is deleted or changes its key). Consumers with unique keys reconcile exactly as before. ### Pre-submission checklist: - [x] Did you explain what problem does this PR solve? Or what new features have been added? - [x] Have you added corresponding test cases? - [ ] Have you modified the corresponding document? - [x] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix-ingress-controller#community) first** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
