[shreemaan-abhishek]

What

The first version of aisix-controller, in Go (controller-runtime). It reconciles ProviderKey, Model and APIKey custom resources (aisix.api7.ai/v1alpha1) into a standalone AISIX gateway's resources file.

How it works

1. Any change to a custom resource, a referenced Secret, the gateway Deployment or its pods re-renders the whole resources file.
   • References resolve by metadata.name.
   • Credentials come from Secrets, and caller keys are written only as their SHA-256.
   • Every $ is escaped, because the file interpolates ${VAR} in every string.
2. The document is checked with aisix validate from the same aisix release, bundled in the image and run with an empty environment.
   • A resource the gateway rejects keeps its previously served entry, or is left out if it was never served. It reports Accepted=False with the gateway's message.
   • The Secret never holds a file the gateway cannot load.
3. A changed file is written to the aisix-resources Secret, and its hash is stamped on the gateway Deployment's pod template to roll the pods. The gateway reloads the file only at boot or on SIGHUP.
4. Programmed=True once every ready gateway pod reports the written file's SHA-256 as applied.config_hash on /status/config.

CRD schemas are generated (cmd/crdgen) from the strict JSON Schemas of aisix v1.9.0, vendored under third_party/aisix. Rules a structural schema cannot hold, such as oneOf branches and if/then, are still enforced by aisix validate.

Commits

Each commit builds and passes go vet and the unit tests:

1. API types
2. vendored aisix v1.9.0 schemas
3. CRD generator
4. renderer
5. validator
6. assembler
7. reconciler and manager
8. manifests, Dockerfile and Makefile
9. kind e2e suite
10. CI
11. README

Tests

• make test: unit tests plus envtest suites (k8s 1.36.2) for reconcile, status conditions, the hash check and the manager wiring.
• make test-aisix: render, assemble and validate tests against the real aisix v1.9.0 binary, including a cross-field rule only the gateway enforces.
• make e2e: a kind cluster with the AISIX 1.9.0 Helm chart (2 replicas), the controller and a mock upstream. All 8 cases pass:
  1. served end to end, with a credential containing $;
  2. both pods report the written hash;
  3. an update takes effect;
  4. the CRD rejects an unknown field;
  5. a gateway-rejected change keeps the served version;
  6. a dangling reference is reported;
  7. deleting the APIKey gives 401;
  8. printer columns show Accepted and Programmed.
• make lint and make crds-check are clean.

Limitations

• Every configuration change restarts the gateway pods.
• One gateway and one namespace per controller.
• No admission webhook.
• The resources file must fit in one Secret.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 31b16120-def8-4c61-a040-b84c0d3ab6cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts