chore: bump api7-ingress-controller to 2.1.0#290
Open
AlinsRan wants to merge 4 commits into
Open
Conversation
- Bump ingress-controller image tag: 2.0.16 -> 2.1.0 - Bump ADC image tag: 0.23.1 -> 0.26.0 - Update CRDs: apisixconsumers, apisixroutes, backendtrafficpolicies Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughRelease update to Helm chart version 0.1.24 with appVersion 2.1.0. Multiple APISIX CustomResourceDefinition schemas enhanced with validation rules, new plugin configuration fields, and API contract refinements. Container image tags updated to corresponding versions. ChangesIngress Controller Release 2.1.0
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
charts/ingress-controller/crds/apisix-crds.yaml (2)
2978-3013:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDon't allow credential entries with only
type.With the current schema, a
credentialsitem can omit bothconfigandsecretRef, and it can also provide both at once. That weakens API validation and accepts objects the controller cannot meaningfully use.Suggested schema guard
items: properties: config: description: Config specifies the credential details for authentication. x-kubernetes-preserve-unknown-fields: true @@ type: description: |- Type specifies the type of authentication to configure credentials for. Can be `jwt-auth`, `basic-auth`, `key-auth`, or `hmac-auth`. enum: - jwt-auth - basic-auth - key-auth - hmac-auth type: string required: - type type: object + x-kubernetes-validations: + - message: exactly one of config or secretRef must be specified + rule: has(self.config) != has(self.secretRef) type: array🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@charts/ingress-controller/crds/apisix-crds.yaml` around lines 2978 - 3013, The credentials item schema currently allows objects with only type or both config and secretRef; update the schema for credentials.items to enforce that exactly one of config or secretRef is present by replacing the current required/type block with a oneOf that has two alternatives: one requiring "config" and the other requiring "secretRef" (keep x-kubernetes-preserve-unknown-fields on config and the existing secretRef properties), ensuring "type" remains required; this makes the schema (credentials, config, secretRef, type) reject objects that provide neither or both fields.
81-154:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRestore the
hmacAuthsource exclusivity check.This schema now admits
hmacAuth: {}and other ambiguous combinations that used to be rejected at admission time. That pushes malformed auth config into reconciliation instead of failing fast at the CRD boundary.Suggested schema guard
hmacAuth: description: HMACAuth configures the HMAC authentication details. properties: secretRef: description: SecretRef references a Kubernetes Secret containing the HMAC credentials. @@ value: description: Value specifies HMAC authentication credentials. @@ required: - secret_key type: object type: object + x-kubernetes-validations: + - message: exactly one of secretRef or value must be specified + rule: has(self.secretRef) != has(self.value)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@charts/ingress-controller/crds/apisix-crds.yaml` around lines 81 - 154, The CRD currently allows hmacAuth: {} which bypasses admission-time validation; restore exclusivity by adding schema constraints on the hmacAuth object so it requires either secretRef or value (and not both/empty). Concretely, inside the hmacAuth schema add a oneOf (or oneOf-equivalent) with two subschemas: one that requires secretRef (object) and disallows value, and another that requires value with its required: ["secret_key"] (and disallows secretRef); also add minProperties: 1 on hmacAuth to reject empty objects. Update the hmacAuth block and its nested secretRef/value definitions to enforce these constraints so malformed empty/ambiguous configs are rejected at CRD validation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@charts/ingress-controller/values.yaml`:
- Line 37: values.yaml currently sets ingress-controller image tag at tag:
"2.1.0" while README.md documents defaults as deployment.image.tag: "2.0.16" and
adc.image.tag: "0.23.1", causing a mismatch and a likely missing upstream image;
update charts/ingress-controller/values.yaml to use a published
ingress-controller tag (or ensure tag "2.1.0" is actually published) and keep
adc.image.tag consistent with the published ADC tag, then update
charts/ingress-controller/README.md to reflect the same default values
(deployment.image.tag and adc.image.tag) and add a brief note about verified
compatibility between the chosen ingress-controller and ADC tags after staging
validation.
---
Outside diff comments:
In `@charts/ingress-controller/crds/apisix-crds.yaml`:
- Around line 2978-3013: The credentials item schema currently allows objects
with only type or both config and secretRef; update the schema for
credentials.items to enforce that exactly one of config or secretRef is present
by replacing the current required/type block with a oneOf that has two
alternatives: one requiring "config" and the other requiring "secretRef" (keep
x-kubernetes-preserve-unknown-fields on config and the existing secretRef
properties), ensuring "type" remains required; this makes the schema
(credentials, config, secretRef, type) reject objects that provide neither or
both fields.
- Around line 81-154: The CRD currently allows hmacAuth: {} which bypasses
admission-time validation; restore exclusivity by adding schema constraints on
the hmacAuth object so it requires either secretRef or value (and not
both/empty). Concretely, inside the hmacAuth schema add a oneOf (or
oneOf-equivalent) with two subschemas: one that requires secretRef (object) and
disallows value, and another that requires value with its required:
["secret_key"] (and disallows secretRef); also add minProperties: 1 on hmacAuth
to reject empty objects. Update the hmacAuth block and its nested
secretRef/value definitions to enforce these constraints so malformed
empty/ambiguous configs are rejected at CRD validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b66f4e2b-7361-4093-87ad-024c6f3e2825
📒 Files selected for processing (3)
charts/ingress-controller/Chart.yamlcharts/ingress-controller/crds/apisix-crds.yamlcharts/ingress-controller/values.yaml
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
2.0.16→2.1.0appVersion:2.0.16→2.1.0,version:0.1.23→0.1.240.23.1→0.26.0Summary by CodeRabbit
New Features
Chores