You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "AlinsRan (via GitHub)" <gi...@apache.org> on 2025/10/16 00:51:46 UTC

[PR] feat: add more config for gatewayproxy [apisix-helm-chart]

AlinsRan opened a new pull request, #885:
URL: https://github.com/apache/apisix-helm-chart/pull/885

   (no comment)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat: add more config for gatewayproxy [apisix-helm-chart]

Posted by "vichaos (via GitHub)" <gi...@apache.org>.
vichaos commented on PR #885:
URL: https://github.com/apache/apisix-helm-chart/pull/885#issuecomment-3421847334

   Hi @AlinsRan and team! 👋
   
   First, thank you for this excellent fix! This addresses a critical security issue we've been experiencing in our production environment.
   
   ## Our Current Situation
   
   We're currently using APISIX Helm chart version **2.12.1** and encountering the exact issue this PR fixes. When we configure the GatewayProxy to use secret-based authentication, the generated resource includes both the hardcoded admin key and our secret reference:
   
   ```yaml
   apiVersion: apisix.apache.org/v1alpha1
   kind: GatewayProxy
   spec:
     provider:
       controlPlane:
         auth:
           adminKey:
             value: edd1c9f034335f136f87ad84b625c8f1  # ❌ Hardcoded default
             valueFrom:
               secretKeyRef:
                 key: ADMIN_KEY
                 name: apisix-private
   ```
   
   This creates security concerns as the hardcoded admin key appears alongside our intended secret-based authentication.
   
   ## Our Configuration
   
   ```yaml
   gatewayProxy:
     provider:
       controlPlane:
         auth:
           type: AdminKey
           adminKey:
             valueFrom:
               secretKeyRef:
                 name: apisix-private
                 key: ADMIN_KEY
   ```
   
   ## Questions
   
   1. **Release Timeline**: When can we expect this fix to be available in a released chart version? Will it be in 2.12.2 or 2.13.0?
   
   2. **Workaround Confirmation**: In the meantime, we've implemented the same conditional logic fix locally. Can you confirm this is the recommended approach until the official release?
   
   ## Impact
   
   This issue affects anyone using secret-based authentication for GatewayProxy in production environments, as it exposes hardcoded credentials alongside the intended secret references.
   
   Thank you again for addressing this issue! Looking forward to the official release. 🙏
   
   ---
   **Environment Details:**
   - Chart Version: 2.12.1
   - APISIX Version: 3.14.1
   - Use Case: Production deployment with secret-based admin authentication


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat: add more config for gatewayproxy [apisix-helm-chart]

Posted by "AlinsRan (via GitHub)" <gi...@apache.org>.
AlinsRan commented on PR #885:
URL: https://github.com/apache/apisix-helm-chart/pull/885#issuecomment-3435843420

   @vichaos Thank you for your feedback. The next version is expected to be released in a few days.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat: add more config for gatewayproxy [apisix-helm-chart]

Posted by "AlinsRan (via GitHub)" <gi...@apache.org>.
AlinsRan merged PR #885:
URL: https://github.com/apache/apisix-helm-chart/pull/885


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org