[shreemaan-abhishek]

First version of the controller: it reconciles ProviderKey, Model and APIKey custom resources (aisix.api7.ai/v1alpha1) into the AISIX gateway's standalone resources file.

How it works

1. Watches the three kinds, the Secrets they reference and the gateway Deployment in its namespace.
2. Renders every resource into one resources.yaml. Credentials come from Secrets, caller keys are written as their SHA-256 hash, provider_key_ref resolves to the ProviderKey's identity, and every $ is escaped for ${VAR} interpolation.
3. Validates the document with aisix_core::filesource::load_from_str, the gateway's own pipeline. A rejected resource keeps its served version and reports Accepted=False; the others still apply.
4. Writes the document to the aisix-resources Secret and stamps its hash on the Deployment's pod template, which rolls the gateway. Programmed=True once the rollout lands.

CRD schemas are generated from aisix-core's strict resource schemas (git dependency pinned to v1.9.0) and converted to structural OpenAPI. make crds regenerates them; a unit test and CI fail when deploy/crds is stale.

Commits

Each step builds on its own with tests and clippy clean:

1. CRD types
2. CRD schema generation from aisix-core
3. Rendering CRs into resources-file entries
4. Validation with the gateway pipeline and per-resource fallback
5. Reconcile loop and CLI
6. Deploy manifests, Dockerfile, Makefile
7. kind-based e2e suite
8. CI
9. README

Testing

• cargo test --locked: 27 unit tests pass. cargo clippy --all-targets -- -D warnings is clean.
• tests/e2e/run.sh: passes on kind with AISIX 1.9.0 from its Helm chart and a mock OpenAI upstream. It covers resources served end to end (including a $ in a credential), an update reaching the gateway, CRD unknown-field rejection, a gateway-rejected change keeping the served version, a dangling reference, and API key revocation.

Limitations

Listed in the README: every config change rolls the gateway pods (standalone AISIX reloads on SIGHUP only), one namespace and one controller replica, no admission webhook.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 1d96990b-c28e-48de-ae27-d4704b1200ea

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts