shreemaan-abhishek opened a new pull request, #2814:
URL: https://github.com/apache/apisix-ingress-controller/pull/2814
### Type of change:
- [x] Bugfix
### What this PR does / why we need it:
When a plugin's `config` fails to unmarshal into an object (for example a
non-object value like `config: ["10.0.0.0/8"]`, which the CRD accepts
because `config` uses `x-kubernetes-preserve-unknown-fields`), the error
was logged and discarded, and the plugin was still applied with an empty
(or secret-only) config. So an `ip-restriction` plugin with a malformed
`whitelist` silently became `ip-restriction: {}` on the published route,
enforcing nothing while the resource reconciled green. The same path
serves `ApisixGlobalRule`, so a malformed global plugin config was
applied gateway-wide in mutated form.
This changes `buildPluginConfig` to return an error on a malformed
config and propagates it through every caller (route plugins,
stream-route plugins, referenced `ApisixPluginConfig`, `ApisixGlobalRule`,
Ingress plugin-config annotation, `ApisixConsumer` plugins). Translation
now fails instead of publishing a fabricated empty object, so the
resource keeps its last good state and the admission webhook rejects the
invalid config upfront. `fillPluginFromExtensionRef`, which silently
skipped such plugins, is aligned to the same fail-hard behavior.
### Pre-submission checklist:
- [x] Did you explain what problem does this PR solve? Or what new features
have been added?
- [x] Have you added corresponding test cases?
- [ ] Have you modified the corresponding document?
- [x] Is this PR backward compatible?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
