AlinsRan commented on code in PR #2804:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2804#discussion_r3643458226
##########
internal/controller/utils.go:
##########
@@ -951,9 +1033,10 @@ func getListenerStatus(
}
// frontendValidation (downstream mTLS) only applies to
Terminate listeners.
- if listener.TLS.FrontendValidation != nil &&
+ // In Gateway API v1.6 it is declared at the Gateway
level (spec.tls.frontend).
+ if validation :=
frontendTLSValidationForListener(gateway, listener); validation != nil &&
(listener.TLS.Mode == nil || *listener.TLS.Mode
== gatewayv1.TLSModeTerminate) {
- validateListenerFrontendValidation(ctx, mrgc,
gateway, listener.TLS.FrontendValidation, &conditionResolvedRefs,
&conditionProgrammed)
+ validateListenerFrontendValidation(ctx, mrgc,
gateway, validation, &conditionResolvedRefs, &conditionProgrammed)
Review Comment:
Follow-up: the data-plane gap is now closed too. `processListenerConfig`
gates both server `certificateRefs` and frontendValidation CA refs with
`checkReferenceGrant`, so an unauthorized cross-namespace cert/CA is no longer
loaded into the data plane — status and what actually gets programmed now
agree. Covered by `TestProcessListenerConfig_CrossNamespaceReferenceGrant`.
(114ae153)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
