shreemaan-abhishek opened a new pull request, #2806: URL: https://github.com/apache/apisix-ingress-controller/pull/2806
## What this PR does The `Consumer` validating webhook checks referenced Secrets and emits a `Referenced Secret '<ns>/<name>' not found` warning **only** when the Secret is absent. A resolvable Secret produces no warning at all. For cross-namespace `secretRef`s (`credential.secretRef.namespace` is caller-settable), that presence/absence difference is an existence oracle: a user with only `Consumer` create/update permission can point a credential at `target-ns/guessed-name`, observe whether the admission warning appears, and enumerate which Secrets exist in namespaces they cannot read, all via the controller's cluster-wide Secret read privilege. ## Fix Gate the cross-namespace lookup on a `ReferenceGrant` (reusing the same `checkReferenceGrant` mechanism the route controllers already use for cross-namespace backend refs): - **No permitting grant** → emit a uniform `Referenced Secret '<ns>/<name>' is not accessible from this Consumer without a ReferenceGrant` warning and **skip the existence check entirely**, so found and not-found are indistinguishable. - **Same-namespace or grant-permitted** → unchanged; the normal not-found warning still fires. ## Tests - `TestConsumerValidator_CrossNamespaceSecretOracleSuppressed` asserts the warning is byte-for-byte identical whether or not the cross-namespace Secret exists (no oracle). - `TestConsumerValidator_CrossNamespaceSecretWithGrant` asserts a `ReferenceGrant` restores normal probing (existing Secret → no warning; missing Secret → not-found warning). - Existing webhook tests updated for the new behavior. ``` go test ./internal/webhook/v1/... # pass go vet ./internal/controller/... ./internal/webhook/... # clean ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
