AlinsRan commented on PR #2826: URL: https://github.com/apache/apisix-ingress-controller/pull/2826#issuecomment-5175968326
Two blockers before this can merge: **1. The ADC side isn't in yet.** api7/adc#537 is still open, and `ADC_VERSION` is pinned to `0.27.1` (Makefile:30) for both the sidecar image and e2e. So adc merge → release → bump here are all needed before `caBundle` does anything. The compatibility note in the description is also off: `SyncTask.opts` / `ValidateTask.opts` in `apps/cli/src/server/schema.ts` are `z.looseObject`, not strict — only the top-level `task` is strict. An unknown `caCert` is silently dropped, not rejected. Net effect if this merges now: the field validates, syncs, and is discarded; the user still gets the same opaque TLS failure this PR set out to remove. Accepted-but-inert is worse than absent. **2. No e2e — and none is possible yet.** Coverage today is unit-level only (translator sets `Config.CaBundle`, executor puts `caCert` on the wire). e2e has no TLS control plane at all: the endpoint is hardcoded `http://…:9180` (`scaffold/apisix_deployer.go:475`) and `tlsVerify` is always `false` (`apisix_deployer.go:488`). Until ADC honors `caCert`, an e2e test could only assert CEL validation and field plumbing — not the one behavior that matters. Suggested order: land api7/adc#537 and release it → bump `ADC_VERSION` → add e2e with a self-signed-CA HTTPS admin endpoint: sync succeeds with `tlsVerify: true` + `caBundle`, fails without it. That needs a TLS-control-plane option in the e2e scaffold first, which is the bulk of the missing work. (The red `e2e-test (apisix-standalone, networking.k8s.io)` is the known standalone flake, unrelated.) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
