Skip to content

Conversation

ronething
Copy link
Contributor

@ronething ronething commented Sep 26, 2025

Type of change:

  • Bugfix
  • New feature provided
  • Improve performance
  • Backport patches
  • Documentation
  • Refactor
  • Chore
  • CI/CD or Tests

What this PR does / why we need it:

  • Implement GatewayProxy admission webhook warnings for missing Service/Secret references.
  • Implement ApisixConsumer admission webhook warnings for missing Secret references.
  • Implement ApisixTls admission webhook warnings for missing Secret references.
  • Implement ApisixRoute admission webhook warnings for missing Service/Secret references.
  • Implement Consumer (v1alpha1) admission webhook warnings for missing Secret references.

Currently, resources such as GRPCRoute and HTTPRoute are still missing, and they will be handled in the next PR.
Then the logic of Ingress webhook and Gateway webhook needs to be expanded, and there is currently no support for checking missing Secret/Service.
Additionally, the current supplement is unit tests, while e2e tests have not been added yet. But these unit tests should be sufficient for this PR.

Pre-submission checklist:

  • Did you explain what problem does this PR solve? Or what new features have been added?
  • Have you added corresponding test cases?
  • Have you modified the corresponding document?
  • Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first

Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
@ronething ronething changed the title feat: add secret/service resource check feat: add secret/service resource checker for webhook Sep 26, 2025
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR implements admission webhook validation for multiple APISIX resources to check for missing Service and Secret references. The validation provides warnings to users when referenced resources don't exist in the cluster, improving user experience and catching configuration errors early.

Key changes:

  • Added a reusable reference checker utility for Service and Secret validation
  • Implemented webhooks for GatewayProxy, ApisixConsumer, ApisixTls, ApisixRoute, and Consumer resources
  • Added comprehensive unit tests for all webhook validators

Reviewed Changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
test/e2e/scaffold/grpc.go Minor import reorganization for better code formatting
internal/webhook/v1/reference/checker.go Core utility for validating Service and Secret references with admission warnings
internal/webhook/v1/*_webhook.go Webhook validators for GatewayProxy, Consumer, ApisixTls, ApisixRoute, and ApisixConsumer
internal/webhook/v1/*_webhook_test.go Comprehensive unit tests for all webhook validators
internal/manager/webhooks.go Registration of new webhooks with the manager
config/webhook/manifests.yaml Webhook configuration manifests for Kubernetes admission controllers

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Signed-off-by: Ashing Zheng <axingfly@gmail.com>
@ronething ronething merged commit 5bb2afd into master Sep 28, 2025
23 checks passed
@ronething ronething deleted the feat/add_resource_verify branch September 28, 2025 03:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants