You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "Revolyssup (via GitHub)" <gi...@apache.org> on 2025/08/20 11:27:05 UTC
[PR] fix: support tlsSecret and externalNodes from http.backends in ApisixRoute [apisix-ingress-controller]
Revolyssup opened a new pull request, #2518:
URL: https://github.com/apache/apisix-ingress-controller/pull/2518
Fixes https://github.com/apache/apisix-ingress-controller/issues/2496
- [ ] Bugfix
- [ ] New feature provided
- [ ] Improve performance
- [ ] Backport patches
- [ ] Documentation
- [ ] Refactor
- [ ] Chore
- [ ] CI/CD or Tests
### What this PR does / why we need it:
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
### Pre-submission checklist:
<!--
Please follow the requirements:
1. Use Draft if the PR is not ready to be reviewed
2. Test is required for the feat/fix PR, unless you have a good reason
3. Doc is required for the feat PR
4. Use a new commit to resolve review instead of `push -f`
5. Use "request review" to notify the reviewer once you have resolved the review
-->
- [ ] Did you explain what problem does this PR solve? Or what new features have been added?
- [ ] Have you added corresponding test cases?
- [ ] Have you modified the corresponding document?
- [ ] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix-ingress-controller#community) first**
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: support tlsSecret from http.backends in ApisixRoute [apisix-ingress-controller]
Posted by "ronething (via GitHub)" <gi...@apache.org>.
ronething commented on code in PR #2518:
URL: https://github.com/apache/apisix-ingress-controller/pull/2518#discussion_r2290319560
##########
test/e2e/crds/v2/route.go:
##########
@@ -1368,4 +1369,60 @@ spec:
})
})
})
+ Context("Test tls secret processed from ApisixUpstream", func() {
+ var Cert = strings.TrimSpace(framework.TestServerCert)
+ var Key = strings.TrimSpace(framework.TestServerKey)
+ createSecret := func(s *scaffold.Scaffold, secretName string) {
+ err := s.NewKubeTlsSecret(secretName, Cert, Key)
+ assert.Nil(GinkgoT(), err, "create secret error")
+ }
+ const apisixRouteSpec = `
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ name: default
+ namespace: %s
+spec:
+ ingressClassName: %s
+ http:
+ - name: rule0
+ match:
+ hosts:
+ - httpbin
+ paths:
+ - /*
+ backends:
+ - serviceName: httpbin-service-e2e-test
+ servicePort: 80
+
+`
+ const apisixUpstreamSpec = `
+apiVersion: apisix.apache.org/v2
+kind: ApisixUpstream
+metadata:
+ name: httpbin-service-e2e-test
+ namespace: %s
+spec:
+ ingressClassName: %s
+ tlsSecret:
+ name: %s
+ namespace: %s
+`
+
+ It("with matching backend", func() {
+ secretName := fmt.Sprintf("test-tls-secret-%s", s.Namespace())
+ createSecret(s, secretName)
+ By("apply apisixupstream")
+ applier.MustApplyAPIv2(types.NamespacedName{Namespace: s.Namespace(), Name: "httpbin-service-e2e-test"},
+ new(apiv2.ApisixUpstream), fmt.Sprintf(apisixUpstreamSpec, s.Namespace(), s.Namespace(), secretName, s.Namespace()))
+ By("apply apisixroute")
+ applier.MustApplyAPIv2(types.NamespacedName{Namespace: s.Namespace(), Name: "default"},
+ new(apiv2.ApisixRoute), fmt.Sprintf(apisixRouteSpec, s.Namespace(), s.Namespace()))
+ time.Sleep(6 * time.Second)
+ services, err := s.DefaultDataplaneResource().Service().List(context.Background())
+ Expect(err).ShouldNot(HaveOccurred(), "list services")
+ service := services[0]
Review Comment:
Directly accessing `services[0]` may result in unexpected errors leading to panic. Perhaps we can consider adding a `HaveLen` check before this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: support tlsSecret and externalNodes from http.backends in ApisixRoute [apisix-ingress-controller]
Posted by "AlinsRan (via GitHub)" <gi...@apache.org>.
AlinsRan commented on code in PR #2518:
URL: https://github.com/apache/apisix-ingress-controller/pull/2518#discussion_r2289971104
##########
internal/controller/apisixroute_controller.go:
##########
@@ -321,6 +358,12 @@ func (r *ApisixRouteReconciler) validateBackends(ctx context.Context, tc *provid
}
} else {
tc.Upstreams[serviceNN] = &au
+ if err = r.processExternalNodes(ctx, tc, au); err != nil {
Review Comment:
The backend uses Kubernetes services for service discovery, which should not allow custom endpoints. I don't think this needs to be handled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: support tlsSecret and externalNodes from http.backends in ApisixRoute [apisix-ingress-controller]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on code in PR #2518:
URL: https://github.com/apache/apisix-ingress-controller/pull/2518#discussion_r2290127795
##########
internal/controller/apisixroute_controller.go:
##########
@@ -321,6 +358,12 @@ func (r *ApisixRouteReconciler) validateBackends(ctx context.Context, tc *provid
}
} else {
tc.Upstreams[serviceNN] = &au
+ if err = r.processExternalNodes(ctx, tc, au); err != nil {
Review Comment:
removed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: support tlsSecret and externalNodes from http.backends in ApisixRoute [apisix-ingress-controller]
Posted by "AlinsRan (via GitHub)" <gi...@apache.org>.
AlinsRan commented on code in PR #2518:
URL: https://github.com/apache/apisix-ingress-controller/pull/2518#discussion_r2289970147
##########
internal/controller/apisixroute_controller.go:
##########
@@ -321,6 +358,12 @@ func (r *ApisixRouteReconciler) validateBackends(ctx context.Context, tc *provid
}
} else {
tc.Upstreams[serviceNN] = &au
+ if err = r.processExternalNodes(ctx, tc, au); err != nil {
Review Comment:
The backend uses Kubernetes services for service discovery, which should not allow custom endpoints. I don't think this needs to be handled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: support tlsSecret from http.backends in ApisixRoute [apisix-ingress-controller]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup merged PR #2518:
URL: https://github.com/apache/apisix-ingress-controller/pull/2518
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org