AlinsRan commented on code in PR #2804:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2804#discussion_r3635519219
##########
internal/controller/utils.go:
##########
@@ -951,9 +1033,10 @@ func getListenerStatus(
}
// frontendValidation (downstream mTLS) only applies to
Terminate listeners.
- if listener.TLS.FrontendValidation != nil &&
+ // In Gateway API v1.6 it is declared at the Gateway
level (spec.tls.frontend).
+ if validation :=
frontendTLSValidationForListener(gateway, listener); validation != nil &&
(listener.TLS.Mode == nil || *listener.TLS.Mode
== gatewayv1.TLSModeTerminate) {
- validateListenerFrontendValidation(ctx, mrgc,
gateway, listener.TLS.FrontendValidation, &conditionResolvedRefs,
&conditionProgrammed)
+ validateListenerFrontendValidation(ctx, mrgc,
gateway, validation, &conditionResolvedRefs, &conditionProgrammed)
Review Comment:
Fixed in d7a05234. `validateListenerFrontendValidation` now counts valid CA
refs: any invalid ref sets `ResolvedRefs=False` with `InvalidCACertificateRef`
(unresolvable/malformed) or `InvalidCACertificateKind` (unsupported kind), and
when none resolve it sets `Accepted=False`/`NoValidCACertificate`. A single
valid ref keeps `Accepted=True`. Tests cover all three cases. One choice to
flag: I mapped a wrong `Group` to `InvalidCACertificateKind` as well (same
"unsupported resource type" bucket as kind) — happy to split it out if you'd
prefer a distinct reason.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
