Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refactor how we process Secrets #441

Closed
pleshakov opened this issue Feb 22, 2023 · 0 comments · Fixed by #807
Closed

Refactor how we process Secrets #441

pleshakov opened this issue Feb 22, 2023 · 0 comments · Fixed by #807
Labels
tech-debt Short-term pain, long-term benefit
Milestone
v1.0.0

Comments

@pleshakov
Copy link
Contributor

pleshakov commented Feb 22, 2023 •
edited by brianehlert
Loading

Currently, Secret are processed differently than other Gateway API resources.

Refactor Secret processing so that it is done similarly to other Gateway API resources: we can move Secrets into the graph, so they are processed as the rest of the resources. After we build the graph, we can build the configuration that will include the secrets to be written on the file disk.

Aha! Link: https://nginx.aha.io/features/NKG-52
@pleshakov pleshakov mentioned this issue Feb 22, 2023
Merged
@pleshakov pleshakov added chore Pull requests for routine tasks and removed proposal labels Feb 22, 2023
@kate-osborn kate-osborn added tech-debt Short-term pain, long-term benefit and removed chore Pull requests for routine tasks labels Mar 21, 2023
@kate-osborn kate-osborn added this to the v1.0.0 milestone Mar 21, 2023
@pleshakov pleshakov mentioned this issue Jun 30, 2023
Merged
6 tasks
pleshakov added a commit to pleshakov/nginx-gateway-fabric that referenced this issue Jul 7, 2023
@pleshakov
Watch for Secrets
0262e1d 
Problem:
NKG doesn't watch for updates of TLS Secrets referenced by Gateway
resource.

Solution:
- Move secrets processing into ChangeProcessor.
- Introduce helper secretResolver component to resolve Secrets (includes
validation) and capture resolved Secrets.
- When building Gateway Listener, resolve Secrets using secretResolver.
- When building Graph, add referenced Secrets by Gateway to the Graph,
including the ones that don't exists.
- When Upserting or Deleting a Secret to ChangeProccessor, use Graph
to determine if the Secret is referenced by the Graph and thus changes
the store.
- When building Configuration, add all TLS Secrets to it referenced
by _valid_ TLS Listeners.
- Update NGINX file.Manager so that it can deal with multiple files
of two types: regular and secret.
- Remove SecretStore and SecretDiskMemoryManager components.

Solves nginx#553
Solves nginx#441

Testing:
- Update affected and add new unit tests
- Manual testing
- Conformance testing. Relevant tests pass:
TestConformance/GatewayInvalidTLSConfiguration
pleshakov added a commit that referenced this issue Jul 7, 2023
@pleshakov
Watch for Secrets (#807)
890fddb 
Problem:
NKG doesn't watch for updates of TLS Secrets referenced by Gateway
resource.

Solution:
- Move secrets processing into ChangeProcessor.
- Introduce helper secretResolver component to resolve Secrets (includes
validation) and capture resolved Secrets.
- When building Gateway Listener, resolve Secrets using secretResolver.
- When building Graph, add referenced Secrets by Gateway to the Graph,
including the ones that don't exists.
- When Upserting or Deleting a Secret to ChangeProccessor, use Graph
to determine if the Secret is referenced by the Graph and thus changes
the store.
- When building Configuration, add all TLS Secrets to it referenced
by _valid_ TLS Listeners.
- Update NGINX file.Manager so that it can deal with multiple files
of two types: regular and secret.
- Remove SecretStore and SecretDiskMemoryManager components.

Solves #553
Solves #441

Testing:
- Update affected and add new unit tests
- Manual testing
- Conformance testing. Relevant tests pass:
TestConformance/GatewayInvalidTLSConfiguration
miledxz added a commit to miledxz/nginx-gateway-fabric that referenced this issue Jan 14, 2025
@miledxz
Watch for Secrets (nginx#807)
a0d700e 
Problem:
NKG doesn't watch for updates of TLS Secrets referenced by Gateway
resource.

Solution:
- Move secrets processing into ChangeProcessor.
- Introduce helper secretResolver component to resolve Secrets (includes
validation) and capture resolved Secrets.
- When building Gateway Listener, resolve Secrets using secretResolver.
- When building Graph, add referenced Secrets by Gateway to the Graph,
including the ones that don't exists.
- When Upserting or Deleting a Secret to ChangeProccessor, use Graph
to determine if the Secret is referenced by the Graph and thus changes
the store.
- When building Configuration, add all TLS Secrets to it referenced
by _valid_ TLS Listeners.
- Update NGINX file.Manager so that it can deal with multiple files
of two types: regular and secret.
- Remove SecretStore and SecretDiskMemoryManager components.

Solves nginx#553
Solves nginx#441

Testing:
- Update affected and add new unit tests
- Manual testing
- Conformance testing. Relevant tests pass:
TestConformance/GatewayInvalidTLSConfiguration
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
tech-debt Short-term pain, long-term benefit
Projects
None yet
Milestone
v1.0.0
Development

Successfully merging a pull request may close this issue.

Watch for Secrets pleshakov/nginx-gateway-fabric
2 participants
@pleshakov @kate-osborn