fix secrets/configmap updates do not trigger a controller reconcile

[alexwo]

What this PR does / why we need it:
Ensure that update to secret and configmas will tigger a reconcile, currently updates are ignored.

Since secrets and configmaps don’t have a spec or generation field, the “TypedGenerationChangedPredicate” will prevent any reconciles from being triggered.

Which issue(s) this PR fixes:
Fixes # #3496

Affected resources that may use outdated secret / configmaps:
EG CRs: Gateway, SecurityPolicy, ClienTraffiPolicies and BackendTLSPolicies.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.52%. Comparing base (6f30397) to head (5707253).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3499      +/-   ##
==========================================
- Coverage   67.53%   67.52%   -0.02%     
==========================================
  Files         168      168              
  Lines       20154    20152       -2     
==========================================
- Hits        13612    13607       -5     
- Misses       5558     5560       +2     
- Partials      984      985       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[alexwo]

/retest

[zirain]

gateway/internal/provider/kubernetes/controller.go

Line 1095 in 72c0cc7

predicate.GenerationChangedPredicate{},

same exists in v1.0.0?

[alexwo]

/retest

[liorokman]

LGTM

[alexwo]

gateway/internal/provider/kubernetes/controller.go

Line 1095 in 72c0cc7

predicate.GenerationChangedPredicate{},

same exists in v1.0.0?

Yes, its about 7 month old.

[zirain]

Can you add a test?

[alexwo]

Can you add a test?

Do you think we should add a component test?

I have a larger change that will also ensure we can perform secret rotations for backend mTLS.
If this makes sense, we can combine this fix with my larger change, which will also include an end-to-end (e2e) test to cover secret updates.

Let me know if this makes sense or we keep this PR small?
(#3500)

[zirain]

I'm talking something like TestValidateServiceForReconcile if possible.

[arkodg]

looking at https://pkg.go.dev/k8s.io/api/core/v1#Secret , it contains ObjectMeta which contains the Generation field
https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#ObjectMeta , does k8s not bump this val when the secret changes ?

[alexwo]

looking at https://pkg.go.dev/k8s.io/api/core/v1#Secret , it contains ObjectMeta which contains the Generation field https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#ObjectMeta , does k8s not bump this val when the secret changes ?

The generation field is typically used in resources with a spec section to track changes to the spec. Each time the spec of a resource changes, the generation is incremented by the Kubernetes API server.

For resources like Secrets and ConfigMaps, changes are made directly to the data, and these resources do not have a spec field or a generation field. Therefore, updates to Secrets and ConfigMaps do not automatically trigger reconciliations in controllers that rely on generation changes.

[arkodg]

thanks for the explaination @alexwo !

[guydc]

/retest

[guydc]

/retest

[alexwo]

/retest

[quyenhoang96]

/retest

[quyenhoang96]

Hi @arkodg. I'm happy that Envoy gateway supports extauth integration in a simple and fast way. I am using extauth feature for authentication. But it is not working with a service with a different namespace than the extauth service. When do you plan to release this cherrypick/release-v1.0.2 version?