Skip to content

feat: support plugins field in ApisixConsumer#2761

Merged
AlinsRan merged 1 commit into
apache:masterfrom
AlinsRan:feat/apisixconsumer-plugins-apache
May 13, 2026
Merged

feat: support plugins field in ApisixConsumer#2761
AlinsRan merged 1 commit into
apache:masterfrom
AlinsRan:feat/apisixconsumer-plugins-apache

Conversation

@AlinsRan

@AlinsRan AlinsRan commented May 9, 2026

Copy link
Copy Markdown
Contributor

Summary

Add a generic plugins field to ApisixConsumerSpec so that consumer-scoped plugins (e.g. limit-count, limit-req) can be attached to an ApisixConsumer resource directly, without being limited to the auth plugins exposed through authParameter.

Changes

  • ApisixConsumerSpec gains a Plugins []ApisixRoutePlugin field, following the same pattern as ApisixRoute and ApisixGlobalRule. Enabled plugins are merged after the auth plugin derived from authParameter; an enabled plugin with the same name takes precedence.
  • authParameter is now optional (omitempty). Both authParameter and plugins are optional at the API level; the controller handles the case where neither is set.
  • Translator updated to process the new Plugins slice via the existing buildPluginConfig helper.
  • Controller and indexer extended to load and index Secrets referenced by spec.plugins[].secretRef, consistent with ApisixRoute and ApisixGlobalRule behavior.
  • deepcopy updated for the new Plugins slice and now-optional AuthParameter pointer (auto-generated by make generate).
  • E2e tests added for two scenarios:
    • authParameter + extra plugins (e.g. limit-count rate limiting at consumer level)
    • plugins only — no authParameter (e.g. key-auth configured directly via plugins)

Example

apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
  name: my-consumer
spec:
  ingressClassName: apisix
  authParameter:
    keyAuth:
      value:
        key: my-secret-key
  plugins:
  - name: limit-count
    enable: true
    config:
      count: 100
      time_window: 60
      rejected_code: 429
      policy: local

Or, using plugins only (without authParameter):

apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
  name: key-auth-consumer
spec:
  ingressClassName: apisix
  plugins:
  - name: key-auth
    enable: true
    config:
      key: my-secret-key

@AlinsRan AlinsRan force-pushed the feat/apisixconsumer-plugins-apache branch 3 times, most recently from 3edc958 to 9c51678 Compare May 10, 2026 20:22
@AlinsRan AlinsRan force-pushed the feat/apisixconsumer-plugins-apache branch 4 times, most recently from 53b9896 to 39da2e4 Compare May 11, 2026 05:44
Add a generic `plugins` field to ApisixConsumerSpec so that
consumer-scoped plugins (e.g. limit-count, limit-req) can be
attached to an ApisixConsumer resource directly, without being
limited to the auth plugins exposed through authParameter.

Key changes:
- ApisixConsumerSpec gains a Plugins []ApisixRoutePlugin field,
  following the same pattern as ApisixRoute and ApisixGlobalRule.
  Enabled plugins are merged after the auth plugin derived from
  authParameter; an enabled entry with the same name takes precedence.
- authParameter is now optional (omitempty). A CEL x-validation rule
  enforces that at least one auth method within authParameter OR at
  least one enabled plugin in plugins must be specified.
- Translator updated to process the new Plugins slice via the
  existing buildPluginConfig helper.
- Controller and indexer extended to load and index Secrets
  referenced by spec.plugins[].secretRef, consistent with
  ApisixRoute and ApisixGlobalRule behavior.
- deepcopy updated for the new Plugins slice.
- No webhook changes required; validation is handled entirely
  by the CRD-level CEL rule (x-kubernetes-validations).
- E2e tests added for authParameter+plugins and plugins-only consumers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@AlinsRan AlinsRan force-pushed the feat/apisixconsumer-plugins-apache branch from 39da2e4 to 9f59ef9 Compare May 11, 2026 21:06
return nil, fmt.Errorf("invalid key auth config: %s", err)
}
plugins["key-auth"] = cfg
} else if ap.BasicAuth != nil {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't we support multi-auth too?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The purpose of this PR is to support plugins.
multi-auth can still be configured through plugins.

@AlinsRan AlinsRan merged commit 336f427 into apache:master May 13, 2026
26 checks passed
@AlinsRan AlinsRan deleted the feat/apisixconsumer-plugins-apache branch May 13, 2026 06:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants