nic-6443 commented on code in PR #2806:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2806#discussion_r3656003649
##########
internal/controller/utils.go:
##########
@@ -1353,6 +1353,25 @@ func checkReferenceGrant(ctx context.Context, cli
client.Client, obj v1beta1.Ref
return false
}
+// CheckConsumerSecretRef reports whether a Consumer in fromNamespace may
reference
+// the Secret at secretNN, honoring ReferenceGrant for cross-namespace
references.
+func CheckConsumerSecretRef(ctx context.Context, cli client.Client,
fromNamespace string, secretNN k8stypes.NamespacedName) bool {
+ secretNS := secretNN.Namespace
+ return checkReferenceGrant(ctx, cli,
Review Comment:
[P2] This bool cannot distinguish a denied reference from a failed
ReferenceGrant lookup. `checkReferenceGrant` turns any `Client.List` error from
the API server, RBAC, or cache into `false`, so the webhook emits a misleading
“without a ReferenceGrant” warning. A later validation lookup can then succeed
and admit the request with a false warning, while persistent failures hide the
infrastructure error. Return `(bool, error)` or a tri-state result, keep
skipping the Secret probe on error, and emit a neutral
authorization-check-failed warning.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
