Skip to content

Commit 522f08f

Browse files
ronethingronething
authored
backport: part 4 (#247)
1 parent 9180318 commit 522f08f

File tree

17 files changed

+835
-177
lines changed

17 files changed

+835
-177
lines changed

‎api/adc/plugin_types.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,11 @@ type JwtAuthConsumerConfig struct {
7777
// used in Consumer object.
7878
// +k8s:deepcopy-gen=true
7979
type HMACAuthConsumerConfig struct {
80-
AccessKey string `json:"access_key" yaml:"access_key"`
81-
SecretKey string `json:"secret_key" yaml:"secret_key"`
80+
KeyID string `json:"key_id,omitempty" yaml:"key_id"`
81+
SecretKey string `json:"secret_key" yaml:"secret_key"`
82+
83+
// Deprecated
84+
AccessKey string `json:"access_key,omitempty" yaml:"access_key"`
8285
Algorithm string `json:"algorithm,omitempty" yaml:"algorithm,omitempty"`
8386
ClockSkew int64 `json:"clock_skew,omitempty" yaml:"clock_skew,omitempty"`
8487
SignedHeaders []string `json:"signed_headers,omitempty" yaml:"signed_headers,omitempty"`

‎api/v2/apisixconsumer_types.go‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -161,23 +161,26 @@ type ApisixConsumerHMACAuth struct {
161161

162162
// ApisixConsumerHMACAuthValue defines configuration for HMAC authentication.
163163
type ApisixConsumerHMACAuthValue struct {
164-
// AccessKey is the identifier used to look up the HMAC secret.
165-
AccessKey string `json:"access_key" yaml:"access_key"`
164+
// KeyID is the identifier used to look up the HMAC secret.
165+
KeyID string `json:"key_id,omitempty" yaml:"key_id"`
166166
// SecretKey is the HMAC secret used to sign the request.
167167
SecretKey string `json:"secret_key" yaml:"secret_key"`
168-
// Algorithm specifies the hashing algorithm (e.g., "hmac-sha256").
168+
169+
// AccessKey is the identifier used to look up the HMAC secret. Deprecated from consumer configuration
170+
AccessKey string `json:"access_key,omitempty" yaml:"access_key"`
171+
// Algorithm specifies the hashing algorithm (e.g., "hmac-sha256"). Deprecated from consumer configuration
169172
Algorithm string `json:"algorithm,omitempty" yaml:"algorithm,omitempty"`
170-
// ClockSkew is the allowed time difference (in seconds) between client and server clocks.
173+
// ClockSkew is the allowed time difference (in seconds) between client and server clocks. Deprecated from consumer configuration
171174
ClockSkew int64 `json:"clock_skew,omitempty" yaml:"clock_skew,omitempty"`
172-
// SignedHeaders lists the headers that must be included in the signature.
175+
// SignedHeaders lists the headers that must be included in the signature. Deprecated from consumer configuration
173176
SignedHeaders []string `json:"signed_headers,omitempty" yaml:"signed_headers,omitempty"`
174-
// KeepHeaders determines whether the HMAC signature headers are preserved after verification.
177+
// KeepHeaders determines whether the HMAC signature headers are preserved after verification. Deprecated from consumer configuration
175178
KeepHeaders bool `json:"keep_headers,omitempty" yaml:"keep_headers,omitempty"`
176-
// EncodeURIParams indicates whether URI parameters are encoded when calculating the signature.
179+
// EncodeURIParams indicates whether URI parameters are encoded when calculating the signature. Deprecated from consumer configuration
177180
EncodeURIParams bool `json:"encode_uri_params,omitempty" yaml:"encode_uri_params,omitempty"`
178-
// ValidateRequestBody enables HMAC validation of the request body.
181+
// ValidateRequestBody enables HMAC validation of the request body. Deprecated from consumer configuration
179182
ValidateRequestBody bool `json:"validate_request_body,omitempty" yaml:"validate_request_body,omitempty"`
180-
// MaxReqBody sets the maximum size (in bytes) of the request body that can be validated.
183+
// MaxReqBody sets the maximum size (in bytes) of the request body that can be validated. Deprecated from consumer configuration
181184
MaxReqBody int64 `json:"max_req_body,omitempty" yaml:"max_req_body,omitempty"`
182185
}
183186

‎config/crd-nocel/apisix.apache.org_v2.yaml‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -101,28 +101,36 @@ spec:
101101
properties:
102102
access_key:
103103
description: AccessKey is the identifier used to look
104-
up the HMAC secret.
104+
up the HMAC secret. Deprecated from consumer configuration
105105
type: string
106106
algorithm:
107107
description: Algorithm specifies the hashing algorithm
108-
(e.g., "hmac-sha256").
108+
(e.g., "hmac-sha256"). Deprecated from consumer configuration
109109
type: string
110110
clock_skew:
111111
description: ClockSkew is the allowed time difference
112-
(in seconds) between client and server clocks.
112+
(in seconds) between client and server clocks. Deprecated
113+
from consumer configuration
113114
format: int64
114115
type: integer
115116
encode_uri_params:
116117
description: EncodeURIParams indicates whether URI parameters
117-
are encoded when calculating the signature.
118+
are encoded when calculating the signature. Deprecated
119+
from consumer configuration
118120
type: boolean
119121
keep_headers:
120122
description: KeepHeaders determines whether the HMAC signature
121-
headers are preserved after verification.
123+
headers are preserved after verification. Deprecated
124+
from consumer configuration
122125
type: boolean
126+
key_id:
127+
description: KeyID is the identifier used to look up the
128+
HMAC secret.
129+
type: string
123130
max_req_body:
124131
description: MaxReqBody sets the maximum size (in bytes)
125-
of the request body that can be validated.
132+
of the request body that can be validated. Deprecated
133+
from consumer configuration
126134
format: int64
127135
type: integer
128136
secret_key:
@@ -131,17 +139,20 @@ spec:
131139
type: string
132140
signed_headers:
133141
description: SignedHeaders lists the headers that must
134-
be included in the signature.
142+
be included in the signature. Deprecated from consumer
143+
configuration
135144
items:
136145
type: string
137146
type: array
138147
validate_request_body:
139148
description: ValidateRequestBody enables HMAC validation
140-
of the request body.
149+
of the request body. Deprecated from consumer configuration
141150
type: boolean
142151
required:
143-
- access_key
144152
- secret_key
153+
oneOf:
154+
- required: ["key_id", "secret_key"]
155+
- required: ["access_key", "secret_key"]
145156
type: object
146157
type: object
147158
jwtAuth:

‎config/crd/bases/apisix.apache.org_apisixconsumers.yaml‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -101,28 +101,36 @@ spec:
101101
properties:
102102
access_key:
103103
description: AccessKey is the identifier used to look
104-
up the HMAC secret.
104+
up the HMAC secret. Deprecated from consumer configuration
105105
type: string
106106
algorithm:
107107
description: Algorithm specifies the hashing algorithm
108-
(e.g., "hmac-sha256").
108+
(e.g., "hmac-sha256"). Deprecated from consumer configuration
109109
type: string
110110
clock_skew:
111111
description: ClockSkew is the allowed time difference
112-
(in seconds) between client and server clocks.
112+
(in seconds) between client and server clocks. Deprecated
113+
from consumer configuration
113114
format: int64
114115
type: integer
115116
encode_uri_params:
116117
description: EncodeURIParams indicates whether URI parameters
117-
are encoded when calculating the signature.
118+
are encoded when calculating the signature. Deprecated
119+
from consumer configuration
118120
type: boolean
119121
keep_headers:
120122
description: KeepHeaders determines whether the HMAC signature
121-
headers are preserved after verification.
123+
headers are preserved after verification. Deprecated
124+
from consumer configuration
122125
type: boolean
126+
key_id:
127+
description: KeyID is the identifier used to look up the
128+
HMAC secret.
129+
type: string
123130
max_req_body:
124131
description: MaxReqBody sets the maximum size (in bytes)
125-
of the request body that can be validated.
132+
of the request body that can be validated. Deprecated
133+
from consumer configuration
126134
format: int64
127135
type: integer
128136
secret_key:
@@ -131,16 +139,16 @@ spec:
131139
type: string
132140
signed_headers:
133141
description: SignedHeaders lists the headers that must
134-
be included in the signature.
142+
be included in the signature. Deprecated from consumer
143+
configuration
135144
items:
136145
type: string
137146
type: array
138147
validate_request_body:
139148
description: ValidateRequestBody enables HMAC validation
140-
of the request body.
149+
of the request body. Deprecated from consumer configuration
141150
type: boolean
142151
required:
143-
- access_key
144152
- secret_key
145153
type: object
146154
type: object

‎config/crd/kustomization.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,12 @@ patches:
2222
name: consumers.apisix.apache.org
2323
group: apiextensions.k8s.io
2424
version: v1
25-
25+
- path: patches/hmac_auth_validation.yaml
26+
target:
27+
kind: CustomResourceDefinition
28+
name: apisixconsumers.apisix.apache.org
29+
group: apiextensions.k8s.io
30+
version: v1
2631
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
2732
# patches here are for enabling the conversion webhook for each CRD
2833
#- path: patches/webhook_in_gatewayproxies.yaml

‎config/crd/patches/hmac_auth_validation.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
- op: replace
2+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/authParameter/properties/hmacAuth/properties/value/required
3+
value: ["secret_key"]
4+
- op: add
5+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/authParameter/properties/hmacAuth/properties/value/oneOf
6+
value:
7+
- required: ["key_id", "secret_key"]
8+
- required: ["access_key", "secret_key"]

‎docs/en/latest/reference/api-reference.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -745,15 +745,16 @@ ApisixConsumerHMACAuthValue defines configuration for HMAC authentication.
745745

746746
| Field | Description |
747747
| --- | --- |
748-
| `access_key` _string_ | AccessKey is the identifier used to look up the HMAC secret. |
748+
| `key_id` _string_ | KeyID is the identifier used to look up the HMAC secret. |
749749
| `secret_key` _string_ | SecretKey is the HMAC secret used to sign the request. |
750-
| `algorithm` _string_ | Algorithm specifies the hashing algorithm (e.g., "hmac-sha256"). |
751-
| `clock_skew` _integer_ | ClockSkew is the allowed time difference (in seconds) between client and server clocks. |
752-
| `signed_headers` _string array_ | SignedHeaders lists the headers that must be included in the signature. |
753-
| `keep_headers` _boolean_ | KeepHeaders determines whether the HMAC signature headers are preserved after verification. |
754-
| `encode_uri_params` _boolean_ | EncodeURIParams indicates whether URI parameters are encoded when calculating the signature. |
755-
| `validate_request_body` _boolean_ | ValidateRequestBody enables HMAC validation of the request body. |
756-
| `max_req_body` _integer_ | MaxReqBody sets the maximum size (in bytes) of the request body that can be validated. |
750+
| `access_key` _string_ | AccessKey is the identifier used to look up the HMAC secret. Deprecated from consumer configuration |
751+
| `algorithm` _string_ | Algorithm specifies the hashing algorithm (e.g., "hmac-sha256"). Deprecated from consumer configuration |
752+
| `clock_skew` _integer_ | ClockSkew is the allowed time difference (in seconds) between client and server clocks. Deprecated from consumer configuration |
753+
| `signed_headers` _string array_ | SignedHeaders lists the headers that must be included in the signature. Deprecated from consumer configuration |
754+
| `keep_headers` _boolean_ | KeepHeaders determines whether the HMAC signature headers are preserved after verification. Deprecated from consumer configuration |
755+
| `encode_uri_params` _boolean_ | EncodeURIParams indicates whether URI parameters are encoded when calculating the signature. Deprecated from consumer configuration |
756+
| `validate_request_body` _boolean_ | ValidateRequestBody enables HMAC validation of the request body. Deprecated from consumer configuration |
757+
| `max_req_body` _integer_ | MaxReqBody sets the maximum size (in bytes) of the request body that can be validated. Deprecated from consumer configuration |
757758

758759

759760
_Appears in:_

‎docs/en/latest/upgrade-guide.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,10 @@ More details: [ADC Backend Differences](https://github.com/api7/adc/blob/2449ca8
150150

151151
The `ApisixClusterConfig` CRD has been removed in 2.0.0. global rules and configurations should now be managed through the `ApisixGlobalRule` CRDs.
152152

153+
#### `ApisixConsumer` - `hmac-auth`
154+
155+
In apisix >= 3.11, most of the hmac-auth related configuration has been deprecated from consumer and moved to service/route level. The name of a `required` field has also been changed from `access_key` to `key_id`. If you have ApisixConsumer configuration with hmac-auth plugin compatible with <3.11, they will not be compatible with newer versions of APISIX. Since all 3+ versions of apisix are supported by ingress controller, if you dont upgrade APISIX, you don't need to change your ApisixConsumer configuration. But when using >3.11, pass all configurations other than `key_id`(previously `access_key`) via PluginConfig or ApisixRoute.
156+
153157
#### Ingress
154158

155159
##### API Version Support

0 commit comments

Comments
 (0)