devshiva75 opened a new issue, #2896:
URL: https://github.com/apache/apisix-ingress-controller/issues/2896
### Current Behavior
When an ApisixRoute references an ApisixPluginConfig that lives in a
different namespace (via plugin_config_namespace), and that ApisixPluginConfig
has a plugin using secretRef, the referenced Secret's values are silently not
merged into the final plugin config pushed to APISIX. The exact same setup
works correctly when the ApisixRoute and ApisixPluginConfig are in the same
namespace.
From the code, its is observed that the secret is cached under {route's
namespace, secretRef} but read back under {plugin config's namespace,
secretRef}. These are the same key only when the route and plugin config happen
to share a namespace. When they differ, the lookup's ok is false, the if block
is skipped entirely, and buildPluginConfig silently returns just the plugin's
config with no indication that the secret merge never happened.
### Expected Behavior
The Secret referenced by a cross-namespace ApisixPluginConfig's plugin
should resolve relative to the ApisixPluginConfig's own namespace and its
values should be merged into the plugin config regardless of which namespace
the referencing ApisixRoute lives in.
### Error Logs
_No response_
### Steps to Reproduce
1. Create namespace ns-a with Secret/my-secret
2. Create namespace ns-b with Secret/my-secret
3. Create ApisixPluginConfig/shared-config in ns-a, with a plugin using
secretRef: my-secret.
4. Create ApisixRoute in ns-a, with http[].plugin_config_name: shared-config
(no plugin_config_namespace needed, same-ns default) → confirm via Admin API
dump (GET /apisix/admin/configs) that the route's merged plugin config contains
secret's value.
5. Create a second ApisixRoute in ns-b, with http[].plugin_config_name:
shared-config and http[].plugin_config_namespace: ns-a → confirm via the same
Admin API check that this route's merged plugin config does not contain the
secret's value
### Environment
- APISIX Ingress controller version (run `apisix-ingress-controller version
--long`)
2.2.0 (reproducible on 2.1.0)
APISIX: 3.18.0, API-driven standalone mode
- Kubernetes cluster version (run `kubectl version`)
1.36.3
- OS version if running APISIX Ingress controller in a bare-metal
environment (run `uname -a`)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
