You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "sunwenbo (via GitHub)" <gi...@apache.org> on 2025/10/11 10:04:48 UTC
[I] bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value [apisix-ingress-controller]
sunwenbo opened a new issue, #2599:
URL: https://github.com/apache/apisix-ingress-controller/issues/2599
### Current Behavior
`root@10-55-2-40:~/apisix-test/nginx# kubectl explain ApisixConsumer.spec.authParameter.jwtAuth.value.
GROUP: apisix.apache.org
KIND: ApisixConsumer
VERSION: v2
FIELD: value <Object>
DESCRIPTION:
ApisixConsumerJwtAuthValue defines the in-place configuration for jwt auth.
FIELDS:
algorithm <string>
<no description>
base64_secret <boolean>
<no description>
exp <integer>
<no description>
key <string> -required-
<no description>
lifetime_grace_period <integer>
<no description>
private_key <string> -required-
<no description>
public_key <string>
<no description>
secret <string>
<no description>
root@10-55-2-40:~/apisix-test/nginx# kubectl apply -f jwt.yaml
The ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value
root@10-55-2-40:~/apisix-test/nginx# cat jwt.yaml
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
name: apisix-jwtauth
spec:
ingressClassName: apisix
authParameter:
jwtAuth:
value:
key: jwt-key-hs256
secret: sunwenbo
algorithm: HS256
base64_secret: false
exp: 3600
lifetime_grace_period: 60`
### Expected Behavior
_No response_
### Error Logs
_No response_
### Steps to Reproduce
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
name: apisix-jwtauth
spec:
ingressClassName: apisix
authParameter:
jwtAuth:
value:
key: jwt-key-hs256
secret: sunwenbo
algorithm: HS256
base64_secret: false
exp: 3600
lifetime_grace_period: 60
### Environment
kubectl version
Client Version: v1.28.15
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.15
APisix 3.13
apisix ingerss controller 2.0.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value [apisix-ingress-controller]
Posted by "Frederickl78 (via GitHub)" <gi...@apache.org>.
Frederickl78 commented on issue #2599:
URL: https://github.com/apache/apisix-ingress-controller/issues/2599#issuecomment-3407268333
Same here. Kubernetes 1.32.7
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value [apisix-ingress-controller]
Posted by "JanEgner (via GitHub)" <gi...@apache.org>.
JanEgner commented on issue #2599:
URL: https://github.com/apache/apisix-ingress-controller/issues/2599#issuecomment-3414993088
The root cause is most likely this line:
[L212](https://github.com/apache/apisix-ingress-controller/blame/351d20a51af496012b822bae225839cac6832750/config/crd/bases/apisix.apache.org_apisixconsumers.yaml#L212)
which defines the private_key field as required although it only makes sense for asymmetric encryption (i.e., if the algorithm is not HSxxx). I guess that line should simply be dropped.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value [apisix-ingress-controller]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on issue #2599:
URL: https://github.com/apache/apisix-ingress-controller/issues/2599#issuecomment-3528801536
@sunwenbo @JanEgner @Frederickl78
We defined this CRD in AIC 1.x. To facilitate straightforward migration, we reimplemented it in 2.0. Consequently, most of the original structure has been retained for compatibility reasons. Before APISIX 3.11, the private_key in asymmetric mode was mandatory. Relaxing restrictions may cause disruption to existing users, so some of them may still be using older versions of APISIX. We need to take this into account.
In https://github.com/apache/apisix/pull/11597 (starting from APISIX version 3.11), we have removed this private_key field. Consequently, the private key no longer requires any input whatsoever.
For compatibility reasons, we are reluctant to directly mark it as non-mandatory. However, in your scenario, you may configure an arbitrary value for it; it will have no effect whatsoever.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value [apisix-ingress-controller]
Posted by "sunwenbo (via GitHub)" <gi...@apache.org>.
sunwenbo closed issue #2599: bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value
URL: https://github.com/apache/apisix-ingress-controller/issues/2599
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value [apisix-ingress-controller]
Posted by "sunwenbo (via GitHub)" <gi...@apache.org>.
sunwenbo commented on issue #2599:
URL: https://github.com/apache/apisix-ingress-controller/issues/2599#issuecomment-3415054594
The latest 3.14.0 apisix has fixed this issue, but I haven't had time to test it yet
https://github.com/apache/apisix/blob/release/3.14/CHANGELOG.md#3141
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Create The apisix ApisixConsumer jwtAuth authentication type algorithm as HS256, and prompt the ApisixConsumer "apisix-jwtauth" is invalid: spec.authParameter.jwtAuth.value.private_key: Required value [apisix-ingress-controller]
Posted by "sunwenbo (via GitHub)" <gi...@apache.org>.
sunwenbo commented on issue #2599:
URL: https://github.com/apache/apisix-ingress-controller/issues/2599#issuecomment-3530565941
> [@sunwenbo](https://github.com/sunwenbo) [@JanEgner](https://github.com/JanEgner) [@Frederickl78](https://github.com/Frederickl78)
>
> 我们在 AIC 1.x 中定义了此 CRD。为了方便迁移，我们在 2.0 版本中重新实现了它。因此，出于兼容性考虑，大部分原始结构都得以保留。在 APISIX 3.11 之前，非对称模式下的 private_key 是必需的。放宽限制可能会对现有用户造成影响，因此他们中的一些人可能仍在使用旧版本的 APISIX。我们需要考虑到这一点。
>
> 在[apache/apisix#11597](https://github.com/apache/apisix/pull/11597)（从 APISIX 版本 3.11 开始）中，我们移除了 `private_key` 字段。因此，私钥不再需要任何输入。 出于兼容性考虑，我们不打算直接将其标记为非必填项。但是，在您的情况下，您可以为其配置任意值；这不会产生任何影响。
Thank you very much for your reply
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org