Kuadrantctl v0.1.0 release #35
Conversation
Codecov Report
@@ Coverage Diff @@
## main #35 +/- ##
=======================================
Coverage ? 31.80%
=======================================
Files ? 15
Lines ? 808
Branches ? 0
=======================================
Hits ? 257
Misses ? 510
Partials ? 41 Continue to review full report at Codecov.
|
| spec: | ||
| containers: | ||
| - name: dogs | ||
| image: quay.io/3scale/authorino:echo-api |
There was a problem hiding this comment.
I'd recommend instead using:
| image: quay.io/3scale/authorino:echo-api | |
| image: quay.io/3scale/authorino-examples:talker-api |
| annotations: | ||
| secret.kuadrant.io/user-id: user-01 | ||
| labels: | ||
| secret.kuadrant.io/managed-by: authorino |
There was a problem hiding this comment.
Authorino may cache this API key secret when it reconciles the AuthConfig because Kuadrant controller will set label selectors that match the ones here. This part is OK.
However, this is NOT enough for Authorino to watch changes related to this API key secret, independently from the reconciliation of the AuthConfig (e.g. key rotation, label update on the secret, deletion of the secret). To put such events within the scope of the Authorino secret reconciler, matching SecretLabelSelectors must as well be specified in the spec of the Authorino CR that is created by kuadrantctl.
If not specified, Authorino will default to watching only secret-related events of resources that include labels matching authorino.kuadrant.io/managed-by=authorino.
There was a problem hiding this comment.
thanks for the tip. I will update to use the default value then.
There was a problem hiding this comment.
added changes to 4707414
| @@ -29,6 +29,7 @@ func Authorino(ns string) *authorinov1beta1.Authorino { | |||
| Enabled: &tlsEnabledTmp, | |||
| }, | |||
| }, | |||
| SecretLabelSelectors: "authorino.kuadrant.io/managed-by=authorino", | |||
There was a problem hiding this comment.
Just for the record, now that SecretLabelSelectors is being set here, it can be anything that makes sense for Kuadrant, such as the previously intended secret.kuadrant.io/managed-by=authorino.
Whatever goes in this field defines what Secret resources Authorino will watch events about.
What goes in authconfigs.spec.identity.apiKey.labelSelectors (which is copied from apiproducts.spec.securityScheme.apiKeyAuth.credential_source.labelSelectors) defines what Secret resources will be cached as valid API keys to authenticate to the hosts of the AuthConfig, when the AuthConfig resource is reconciled.
There was a problem hiding this comment.
I just wanted to do it explicit for completeness
Thanks!
This PR includes: