nic-6443 commented on code in PR #2805:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2805#discussion_r3637311143
##########
internal/controller/consumer_controller.go:
##########
@@ -253,6 +254,27 @@ func (r *ConsumerReconciler) processSpec(ctx
context.Context, tctx *provider.Tra
if credential.SecretRef.Namespace != nil {
ns = *credential.SecretRef.Namespace
}
+ // A cross-namespace SecretRef needs a ReferenceGrant, same as
routes.
+ secretNS := gatewayv1.Namespace(ns)
+ if permitted := checkReferenceGrant(ctx,
Review Comment:
Checked this out locally and it holds up. Nice that the single change point
covers admission too — `PrepareConsumerForValidation` calls `processSpec`, so
the webhook gets the same gate for free, which is why the webhook test passes
without touching webhook code. I reverted just this hunk and both the
controller and webhook tests fail, so the tests really do pin the invariant.
One thing worth a release note: `checkReferenceGrant` returns false for a
cross-namespace ref when `enableReferenceGrant` is off, and that flag is set
from whether the ReferenceGrant CRD is installed (`manager/run.go`). So on a
cluster without that CRD this goes from "cross-namespace secretRef works" to
"always refused", not "unchecked". That's the right fail-closed direction and
matches what the route controllers already do, but anyone relying on
cross-namespace Consumer secretRef today will need a grant (and the CRD) after
upgrading.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
