@@ -55,42 +55,54 @@ const (
5555func (t * Translator ) TranslateApisixConsumer (tctx * provider.TranslateContext , ac * v2.ApisixConsumer ) (* TranslateResult , error ) {
5656 result := & TranslateResult {}
5757 plugins := make (adctypes.Plugins )
58- if ac .Spec .AuthParameter .KeyAuth != nil {
59- cfg , err := t .translateConsumerKeyAuthPlugin (tctx , ac .Namespace , ac .Spec .AuthParameter .KeyAuth )
60- if err != nil {
61- return nil , fmt .Errorf ("invalid key auth config: %s" , err )
58+ if ap := ac .Spec .AuthParameter ; ap != nil {
59+ if ap .KeyAuth != nil {
60+ cfg , err := t .translateConsumerKeyAuthPlugin (tctx , ac .Namespace , ap .KeyAuth )
61+ if err != nil {
62+ return nil , fmt .Errorf ("invalid key auth config: %s" , err )
63+ }
64+ plugins ["key-auth" ] = cfg
65+ } else if ap .BasicAuth != nil {
66+ cfg , err := t .translateConsumerBasicAuthPlugin (tctx , ac .Namespace , ap .BasicAuth )
67+ if err != nil {
68+ return nil , fmt .Errorf ("invalid basic auth config: %s" , err )
69+ }
70+ plugins ["basic-auth" ] = cfg
71+ } else if ap .JwtAuth != nil {
72+ cfg , err := t .translateConsumerJwtAuthPlugin (tctx , ac .Namespace , ap .JwtAuth )
73+ if err != nil {
74+ return nil , fmt .Errorf ("invalid jwt auth config: %s" , err )
75+ }
76+ plugins ["jwt-auth" ] = cfg
77+ } else if ap .WolfRBAC != nil {
78+ cfg , err := t .translateConsumerWolfRBACPlugin (tctx , ac .Namespace , ap .WolfRBAC )
79+ if err != nil {
80+ return nil , fmt .Errorf ("invalid wolf rbac config: %s" , err )
81+ }
82+ plugins ["wolf-rbac" ] = cfg
83+ } else if ap .HMACAuth != nil {
84+ cfg , err := t .translateConsumerHMACAuthPlugin (tctx , ac .Namespace , ap .HMACAuth )
85+ if err != nil {
86+ return nil , fmt .Errorf ("invalid hmac auth config: %s" , err )
87+ }
88+ plugins ["hmac-auth" ] = cfg
89+ } else if ap .LDAPAuth != nil {
90+ cfg , err := t .translateConsumerLDAPAuthPlugin (tctx , ac .Namespace , ap .LDAPAuth )
91+ if err != nil {
92+ return nil , fmt .Errorf ("invalid ldap auth config: %s" , err )
93+ }
94+ plugins ["ldap-auth" ] = cfg
6295 }
63- plugins ["key-auth" ] = cfg
64- } else if ac .Spec .AuthParameter .BasicAuth != nil {
65- cfg , err := t .translateConsumerBasicAuthPlugin (tctx , ac .Namespace , ac .Spec .AuthParameter .BasicAuth )
66- if err != nil {
67- return nil , fmt .Errorf ("invalid basic auth config: %s" , err )
68- }
69- plugins ["basic-auth" ] = cfg
70- } else if ac .Spec .AuthParameter .JwtAuth != nil {
71- cfg , err := t .translateConsumerJwtAuthPlugin (tctx , ac .Namespace , ac .Spec .AuthParameter .JwtAuth )
72- if err != nil {
73- return nil , fmt .Errorf ("invalid jwt auth config: %s" , err )
74- }
75- plugins ["jwt-auth" ] = cfg
76- } else if ac .Spec .AuthParameter .WolfRBAC != nil {
77- cfg , err := t .translateConsumerWolfRBACPlugin (tctx , ac .Namespace , ac .Spec .AuthParameter .WolfRBAC )
78- if err != nil {
79- return nil , fmt .Errorf ("invalid wolf rbac config: %s" , err )
80- }
81- plugins ["wolf-rbac" ] = cfg
82- } else if ac .Spec .AuthParameter .HMACAuth != nil {
83- cfg , err := t .translateConsumerHMACAuthPlugin (tctx , ac .Namespace , ac .Spec .AuthParameter .HMACAuth )
84- if err != nil {
85- return nil , fmt .Errorf ("invalid hmac auth config: %s" , err )
86- }
87- plugins ["hmac-auth" ] = cfg
88- } else if ac .Spec .AuthParameter .LDAPAuth != nil {
89- cfg , err := t .translateConsumerLDAPAuthPlugin (tctx , ac .Namespace , ac .Spec .AuthParameter .LDAPAuth )
90- if err != nil {
91- return nil , fmt .Errorf ("invalid ldap auth config: %s" , err )
96+ }
97+
98+ // Merge generic consumer-scoped plugins. Only enabled entries are merged;
99+ // an enabled plugin with the same name as an auth plugin derived from authParameter takes precedence.
100+ for _ , plugin := range ac .Spec .Plugins {
101+ if ! plugin .Enable {
102+ continue
92103 }
93- plugins ["ldap-auth" ] = cfg
104+ config := t .buildPluginConfig (plugin , ac .Namespace , tctx .Secrets )
105+ plugins [plugin .Name ] = config
94106 }
95107
96108 username := adctypes .ComposeConsumerName (ac .Namespace , ac .Name )
@@ -107,7 +119,9 @@ func (t *Translator) translateConsumerKeyAuthPlugin(tctx *provider.TranslateCont
107119 if cfg .Value != nil {
108120 return & adctypes.KeyAuthConsumerConfig {Key : cfg .Value .Key }, nil
109121 }
110-
122+ if cfg .SecretRef == nil {
123+ return nil , fmt .Errorf ("key-auth: either value or secretRef must be specified" )
124+ }
111125 sec := tctx .Secrets [k8stypes.NamespacedName {
112126 Namespace : consumerNamespace ,
113127 Name : cfg .SecretRef .Name ,
@@ -129,7 +143,9 @@ func (t *Translator) translateConsumerBasicAuthPlugin(tctx *provider.TranslateCo
129143 Password : cfg .Value .Password ,
130144 }, nil
131145 }
132-
146+ if cfg .SecretRef == nil {
147+ return nil , fmt .Errorf ("basic-auth: either value or secretRef must be specified" )
148+ }
133149 sec := tctx .Secrets [k8stypes.NamespacedName {
134150 Namespace : consumerNamespace ,
135151 Name : cfg .SecretRef .Name ,
@@ -159,6 +175,9 @@ func (t *Translator) translateConsumerWolfRBACPlugin(tctx *provider.TranslateCon
159175 HeaderPrefix : cfg .Value .HeaderPrefix ,
160176 }, nil
161177 }
178+ if cfg .SecretRef == nil {
179+ return nil , fmt .Errorf ("wolf-rbac: either value or secretRef must be specified" )
180+ }
162181 sec := tctx .Secrets [k8stypes.NamespacedName {
163182 Namespace : consumerNamespace ,
164183 Name : cfg .SecretRef .Name ,
@@ -194,6 +213,9 @@ func (t *Translator) translateConsumerJwtAuthPlugin(tctx *provider.TranslateCont
194213 }, nil
195214 }
196215
216+ if cfg .SecretRef == nil {
217+ return nil , fmt .Errorf ("jwt-auth: either value or secretRef must be specified" )
218+ }
197219 sec := tctx .Secrets [k8stypes.NamespacedName {
198220 Namespace : consumerNamespace ,
199221 Name : cfg .SecretRef .Name ,
@@ -251,6 +273,9 @@ func (t *Translator) translateConsumerHMACAuthPlugin(tctx *provider.TranslateCon
251273 }, nil
252274 }
253275
276+ if cfg .SecretRef == nil {
277+ return nil , fmt .Errorf ("hmac-auth: either value or secretRef must be specified" )
278+ }
254279 sec := tctx .Secrets [k8stypes.NamespacedName {
255280 Namespace : consumerNamespace ,
256281 Name : cfg .SecretRef .Name ,
@@ -357,6 +382,9 @@ func (t *Translator) translateConsumerLDAPAuthPlugin(tctx *provider.TranslateCon
357382 }, nil
358383 }
359384
385+ if cfg .SecretRef == nil {
386+ return nil , fmt .Errorf ("ldap-auth: either value or secretRef must be specified" )
387+ }
360388 sec := tctx .Secrets [k8stypes.NamespacedName {
361389 Namespace : consumerNamespace ,
362390 Name : cfg .SecretRef .Name ,
0 commit comments