feat: support plugins field in ApisixConsumer#2761
Merged
AlinsRan merged 1 commit intoMay 13, 2026
Conversation
3edc958 to
9c51678
Compare
53b9896 to
39da2e4
Compare
Add a generic `plugins` field to ApisixConsumerSpec so that consumer-scoped plugins (e.g. limit-count, limit-req) can be attached to an ApisixConsumer resource directly, without being limited to the auth plugins exposed through authParameter. Key changes: - ApisixConsumerSpec gains a Plugins []ApisixRoutePlugin field, following the same pattern as ApisixRoute and ApisixGlobalRule. Enabled plugins are merged after the auth plugin derived from authParameter; an enabled entry with the same name takes precedence. - authParameter is now optional (omitempty). A CEL x-validation rule enforces that at least one auth method within authParameter OR at least one enabled plugin in plugins must be specified. - Translator updated to process the new Plugins slice via the existing buildPluginConfig helper. - Controller and indexer extended to load and index Secrets referenced by spec.plugins[].secretRef, consistent with ApisixRoute and ApisixGlobalRule behavior. - deepcopy updated for the new Plugins slice. - No webhook changes required; validation is handled entirely by the CRD-level CEL rule (x-kubernetes-validations). - E2e tests added for authParameter+plugins and plugins-only consumers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
39da2e4 to
9f59ef9
Compare
nic-6443
approved these changes
May 12, 2026
| return nil, fmt.Errorf("invalid key auth config: %s", err) | ||
| } | ||
| plugins["key-auth"] = cfg | ||
| } else if ap.BasicAuth != nil { |
Contributor
There was a problem hiding this comment.
shouldn't we support multi-auth too?
Contributor
Author
There was a problem hiding this comment.
The purpose of this PR is to support plugins.
multi-auth can still be configured through plugins.
shreemaan-abhishek
approved these changes
May 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a generic
pluginsfield toApisixConsumerSpecso that consumer-scoped plugins (e.g.limit-count,limit-req) can be attached to anApisixConsumerresource directly, without being limited to the auth plugins exposed throughauthParameter.Changes
ApisixConsumerSpecgains aPlugins []ApisixRoutePluginfield, following the same pattern asApisixRouteandApisixGlobalRule. Enabled plugins are merged after the auth plugin derived fromauthParameter; an enabled plugin with the same name takes precedence.authParameteris now optional (omitempty). BothauthParameterandpluginsare optional at the API level; the controller handles the case where neither is set.Pluginsslice via the existingbuildPluginConfighelper.spec.plugins[].secretRef, consistent withApisixRouteandApisixGlobalRulebehavior.Pluginsslice and now-optionalAuthParameterpointer (auto-generated bymake generate).authParameter+ extraplugins(e.g.limit-countrate limiting at consumer level)pluginsonly — noauthParameter(e.g.key-authconfigured directly via plugins)Example
Or, using
pluginsonly (withoutauthParameter):