shreemaan-abhishek commented on code in PR #2806:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2806#discussion_r3656438892
##########
internal/webhook/v1/consumer_webhook.go:
##########
@@ -134,6 +134,14 @@ func (v *ConsumerCustomValidator) collectWarnings(ctx
context.Context, consumer
}
visited[nn] = struct{}{}
+ // Don't probe cross-namespace Secrets that no ReferenceGrant
permits: the
+ // found/not-found warning difference would leak Secret
existence across
+ // namespaces. Emit a uniform message and skip the lookup.
+ if namespace != defaultNamespace &&
!controller.CheckConsumerSecretRef(ctx, v.Client, defaultNamespace, nn) {
+ warnings = append(warnings, fmt.Sprintf("Referenced
Secret '%s/%s' is not accessible from this Consumer without a ReferenceGrant",
nn.Namespace, nn.Name))
+ continue
+ }
Review Comment:
Good catch, you're right that this is the same oracle rather than a separate
finding. Fixed in 87b26f9a: `extractCredentialKey` now applies the same
`CheckConsumerSecretRef` gate before the Secret `Get` and treats an unpermitted
cross-namespace ref as absent, so duplicate detection no longer reads it or
produces a different outcome for a colliding key.
Added
`TestConsumerValidator_CrossNamespaceKeyAuthDuplicateOracleSuppressed`, which
drives a key-auth credential with a cross-namespace `secretRef` and asserts the
response is identical whether the Secret exists with a colliding key or is
absent, and that the `duplicate key-auth credential key` error never surfaces.
Confirmed it fails without the gate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
