-
Notifications
You must be signed in to change notification settings - Fork 356
feat: add secret/service resource checker for webhook #2580
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
Signed-off-by: Ashing Zheng <axingfly@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR implements admission webhook validation for multiple APISIX resources to check for missing Service and Secret references. The validation provides warnings to users when referenced resources don't exist in the cluster, improving user experience and catching configuration errors early.
Key changes:
- Added a reusable reference checker utility for Service and Secret validation
- Implemented webhooks for GatewayProxy, ApisixConsumer, ApisixTls, ApisixRoute, and Consumer resources
- Added comprehensive unit tests for all webhook validators
Reviewed Changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
File | Description |
---|---|
test/e2e/scaffold/grpc.go |
Minor import reorganization for better code formatting |
internal/webhook/v1/reference/checker.go |
Core utility for validating Service and Secret references with admission warnings |
internal/webhook/v1/*_webhook.go |
Webhook validators for GatewayProxy, Consumer, ApisixTls, ApisixRoute, and ApisixConsumer |
internal/webhook/v1/*_webhook_test.go |
Comprehensive unit tests for all webhook validators |
internal/manager/webhooks.go |
Registration of new webhooks with the manager |
config/webhook/manifests.yaml |
Webhook configuration manifests for Kubernetes admission controllers |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
Type of change:
What this PR does / why we need it:
Currently, resources such as GRPCRoute and HTTPRoute are still missing, and they will be handled in the next PR.
Then the logic of Ingress webhook and Gateway webhook needs to be expanded, and there is currently no support for checking missing Secret/Service.
Additionally, the current supplement is unit tests, while e2e tests have not been added yet. But these unit tests should be sufficient for this PR.
Pre-submission checklist: