Fix hmac secret

[zhaohuabing]

This PR does the following:

• Generates an HMAC secret and stores it in a K8s secret in the CertGen job.
• Watches this k8s secret in the Kuberetes provider.
• Uses the HMAC generated in the above step for envoy ouath2 filter configuration.

[arkodg]

what happens during upgrade if this secret already exists ? do we skip or overwrite ?

[arkodg]

relates to

gateway/internal/provider/kubernetes/secrets.go

Line 84 in ce1eb54

func CreateOrUpdateSecrets(ctx context.Context, client client.Client, secrets []corev1.Secret, update bool) ([]corev1.Secret, error) {

[zhaohuabing]

The creation of HMAC secret will be skipped in CreateOrUpdateSecrets if it's already there, like the other certs. No changes are needed.

[arkodg]

hey @zhaohuabing has this been tested ? are you sure we are reconciling this secret ? I think we may need some more code in

gateway/internal/provider/kubernetes/controller.go

Line 138 in ce1eb54

func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Request) (reconcile.Result, error) {

to make sure this secret is part of the resources

[zhaohuabing]

hey @zhaohuabing has this been tested ? are you sure we are reconciling this secret ?

I haven't tested it manually yet. It should be covered by the OIDC e2e test: #2730

I think we may need some more code in

gateway/internal/provider/kubernetes/controller.go

Line 138 in ce1eb54

func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Request) (reconcile.Result, error) {

to make sure this secret is part of the resources

Yeah, I missed that :-(. It's fixed.

[codecov]

Codecov Report

Attention: Patch coverage is 61.17647% with 33 lines in your changes are missing coverage. Please review.

Project coverage is 63.46%. Comparing base (f1ac586) to head (5b3f3f6).

Files	Patch %	Lines
internal/gatewayapi/securitypolicy.go	50.00%	5 Missing and 2 partials ⚠️
internal/provider/kubernetes/secrets.go	0.00%	7 Missing ⚠️
internal/crypto/certgen.go	66.66%	4 Missing and 2 partials ⚠️
internal/ir/zz_generated.deepcopy.go	0.00%	5 Missing ⚠️
internal/provider/kubernetes/predicates.go	66.66%	2 Missing and 1 partial ⚠️
internal/provider/kubernetes/controller.go	92.30%	2 Missing ⚠️
internal/gatewayapi/runner/runner.go	0.00%	1 Missing ⚠️
internal/ir/xds.go	0.00%	1 Missing ⚠️
internal/xds/translator/oidc.go	75.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2768      +/-   ##
==========================================
+ Coverage   63.45%   63.46%   +0.01%     
==========================================
  Files         125      125              
  Lines       20544    20604      +60     
==========================================
+ Hits        13036    13077      +41     
- Misses       6672     6690      +18     
- Partials      836      837       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Xunzhuo]

/retest

[Xunzhuo]

/retest

[arkodg]

🚀