Skip to content

[APK] Template secrets for custom secret #1334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sgayangi merged 3 commits into from
Dec 22, 2025
Merged

[APK] Template secrets for custom secret #1334

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3254778
Template secrets for custom secret
sgayangi Dec 17, 2025
51633b6
Fix subscription burst control
sgayangi Dec 19, 2025
fd44cbe
Update grpc-health-probe version
sgayangi Dec 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions apim-apk-agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ ENV LANG=C.UTF-8

ARG APK_USER=wso2
ARG APK_USER_ID=10001
ARG CHECKSUM_AMD64="8302d54fc41d4ffbfea6871b6a04584265d5eabbe738aee2966f9a574b6f17d1"
ARG CHECKSUM_ARM64="8ebe934e7cf29a65ca31d671a97949467fba6977d656b5e6d6c40902ae7402f6"
ARG CHECKSUM_AMD64="b92eeb7e9ffbc3b156f85f3bb18129bd18a27f739330f6e9d3fcb630898df442"
ARG CHECKSUM_ARM64="e5d1951a7d57de20ea88e660d555bb2563c82f520406e43bf5f4d67fa53b4606"
ARG APK_USER_GROUP=wso2
ARG APK_USER_GROUP_ID=10001
ARG APK_USER_HOME=/home/${APK_USER}
Expand All @@ -47,7 +47,7 @@ RUN \
&& echo '[ ! -z "${TERM}" -a -r /etc/motd ] && cat /etc/motd' >> /etc/bash.bashrc; echo "${MOTD}" > /etc/motd

RUN \
wget -q https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.37/grpc_health_probe-linux-${TARGETARCH} \
wget -q https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.42/grpc_health_probe-linux-${TARGETARCH} \
&& mv grpc_health_probe-linux-${TARGETARCH} ${GRPC_HEALTH_PROBE_PATH} \
&& if [ "${TARGETARCH}" = "amd64" ]; then echo "${CHECKSUM_AMD64} ${GRPC_HEALTH_PROBE_PATH}" | sha256sum -c -; fi

Expand Down
12 changes: 12 additions & 0 deletions apim-apk-agent/internal/k8sClient/k8s_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,6 +476,10 @@ func DeploySubscriptionRateLimitPolicyCR(policy eventhubTypes.SubscriptionPolicy
RequestsPerUnit: uint32(policy.DefaultLimit.RequestCount.RequestCount),
Unit: policy.DefaultLimit.RequestCount.TimeUnit,
},
BurstControl: &dpv1alpha3.BurstControl{
RequestsPerUnit: uint32(policy.RateLimitCount),
Unit: policy.RateLimitTimeUnit,
},
},
},
TargetRef: gwapiv1b1.NamespacedPolicyTargetReference{Group: constants.GatewayGroup, Kind: "Subscription", Name: "default"},
Expand All @@ -489,8 +493,16 @@ func DeploySubscriptionRateLimitPolicyCR(policy eventhubTypes.SubscriptionPolicy
} else {
crRateLimitPolicy.Spec.Override.Subscription.StopOnQuotaReach = policy.StopOnQuotaReach
crRateLimitPolicy.Spec.Override.Subscription.Organization = policy.TenantDomain
if crRateLimitPolicy.Spec.Override.Subscription.RequestCount == nil {
crRateLimitPolicy.Spec.Override.Subscription.RequestCount = &dpv1alpha3.RequestCount{}
}
crRateLimitPolicy.Spec.Override.Subscription.RequestCount.RequestsPerUnit = uint32(policy.DefaultLimit.RequestCount.RequestCount)
crRateLimitPolicy.Spec.Override.Subscription.RequestCount.Unit = policy.DefaultLimit.RequestCount.TimeUnit
if crRateLimitPolicy.Spec.Override.Subscription.BurstControl == nil {
crRateLimitPolicy.Spec.Override.Subscription.BurstControl = &dpv1alpha3.BurstControl{}
}
crRateLimitPolicy.Spec.Override.Subscription.BurstControl.RequestsPerUnit = uint32(policy.RateLimitCount)
crRateLimitPolicy.Spec.Override.Subscription.BurstControl.Unit = policy.RateLimitTimeUnit
if err := k8sClient.Update(context.Background(), &crRateLimitPolicy); err != nil {
loggers.LoggerK8sClient.Error("Unable to update RateLimitPolicies CR: " + err.Error())
} else {
Expand Down
38 changes: 32 additions & 6 deletions apim-apk-agent/internal/synchronizer/ratelimit_policy_fetcher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,12 +141,25 @@ func FetchRateLimitPoliciesOnEvent(ratelimitName string, organization string, c
logger.LoggerSynchronizer.Debugf("Policies received: %v", rateLimitPolicyList.List)
var rateLimitPolicies []eventhubTypes.RateLimitPolicy = rateLimitPolicyList.List
for _, policy := range rateLimitPolicies {
if policy.DefaultLimit.RequestCount.TimeUnit == "min" {
switch policy.DefaultLimit.RequestCount.TimeUnit {
case "min":
policy.DefaultLimit.RequestCount.TimeUnit = "Minute"
} else if policy.DefaultLimit.RequestCount.TimeUnit == "hour" {
case "hour":
policy.DefaultLimit.RequestCount.TimeUnit = "Hour"
} else if policy.DefaultLimit.RequestCount.TimeUnit == "day" {
case "day":
policy.DefaultLimit.RequestCount.TimeUnit = "Day"
default:
logger.LoggerSynchronizer.Errorf("Unsupported timeunit %s", policy.DefaultLimit.RequestCount.TimeUnit)
continue
}
switch policy.RateLimitTimeUnit {
case "min":
policy.RateLimitTimeUnit = "Minute"
case "sec":
policy.RateLimitTimeUnit = "Second"
default:
logger.LoggerSynchronizer.Errorf("Unsupported timeunit %s", policy.RateLimitTimeUnit)
continue
}
managementserver.AddRateLimitPolicy(policy)
logger.LoggerSynchronizer.Infof("RateLimit Policy added to internal map: %v", policy)
Expand Down Expand Up @@ -317,12 +330,25 @@ func FetchSubscriptionRateLimitPoliciesOnEvent(ratelimitName string, organizatio
logger.LoggerSynchronizer.Errorf("AIQuota type response recieved but no data found. %+v", policy.DefaultLimit)
}
} else {
if policy.DefaultLimit.RequestCount.TimeUnit == "min" {
switch policy.DefaultLimit.RequestCount.TimeUnit {
case "min":
policy.DefaultLimit.RequestCount.TimeUnit = "Minute"
} else if policy.DefaultLimit.RequestCount.TimeUnit == "hours" {
case "hours":
policy.DefaultLimit.RequestCount.TimeUnit = "Hour"
} else if policy.DefaultLimit.RequestCount.TimeUnit == "days" {
case "days":
policy.DefaultLimit.RequestCount.TimeUnit = "Day"
default:
logger.LoggerSynchronizer.Errorf("Unsupported timeunit %s", policy.DefaultLimit.RequestCount.TimeUnit)
continue
}
switch policy.RateLimitTimeUnit {
case "min":
policy.RateLimitTimeUnit = "Minute"
case "sec":
policy.RateLimitTimeUnit = "Second"
default:
logger.LoggerSynchronizer.Errorf("Unsupported timeunit %s", policy.RateLimitTimeUnit)
continue
}
managementserver.AddSubscriptionPolicy(policy)
logger.LoggerSynchronizer.Infof("RateLimit Policy added to internal map: %v", policy)
Expand Down
14 changes: 8 additions & 6 deletions apim-apk-agent/pkg/eventhub/types/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,12 +178,14 @@ type RateLimitPolicyList struct {

// RateLimitPolicy for struct RateLimitPolicy Info events
type RateLimitPolicy struct {
TenantDomain string `json:"tenantDomain"`
Name string `json:"name"`
QuotaType string `json:"quotaType"`
ConditionGroups []ConditionGroup `json:"conditionGroups"`
ApplicableLevel string `json:"applicableLevel"`
DefaultLimit DefaultLimit `json:"defaultLimit"`
TenantDomain string `json:"tenantDomain"`
Name string `json:"name"`
QuotaType string `json:"quotaType"`
ConditionGroups []ConditionGroup `json:"conditionGroups"`
ApplicableLevel string `json:"applicableLevel"`
DefaultLimit DefaultLimit `json:"defaultLimit"`
RateLimitCount int `json:"rateLimitCount"`
RateLimitTimeUnit string `json:"rateLimitTimeUnit"`
}

// ConditionGroup represents the condition group within the response.
Expand Down
8 changes: 4 additions & 4 deletions helm-charts/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,13 +70,13 @@ spec:
mountPath: /home/wso2/conf/
- name: apk-agent-certificates
mountPath: /home/wso2/security/keystore/apk-agent.key
subPath: tls.key
subPath: {{ .Values.configs.tls.certKeyFilename | default "tls.key" }}
- name: apk-agent-certificates
mountPath: /home/wso2/security/keystore/apk-agent.crt
subPath: tls.crt
subPath: {{ .Values.configs.tls.certFilename | default "tls.crt" }}
- name: apk-agent-certificates
mountPath: /home/wso2/security/truststore/apk-agent-ca.crt
subPath: ca.crt
subPath: {{ .Values.configs.tls.certCAFilename | default "ca.crt" }}
readinessProbe:
exec:
command: [ "sh", "check_health.sh" ]
Expand Down Expand Up @@ -106,4 +106,4 @@ spec:
name: {{ .Release.Name }}-log-conf
- name: apk-agent-certificates
secret:
secretName: apk-agent-server-cert
secretName: {{ .Values.configs.tls.secretName | default "apk-agent-server-cert"}}
Copy link

@coderabbitai coderabbitai bot Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Resolve the secretName inconsistency.

The default value "apk-agent-server-cert" here doesn't match the value "keys-certs" set in values.yaml (line 61). When values.yaml is used, the secret name will be "keys-certs", but if someone deploys without specifying this value, it will fall back to "apk-agent-server-cert". This mismatch can lead to:

  • Deployment failures if the expected secret doesn't exist
  • Confusion about which secret name to create

Consider one of these approaches:

Option 1: Match the values.yaml default

-            secretName: {{ .Values.configs.tls.secretName | default "apk-agent-server-cert"}}
+            secretName: {{ .Values.configs.tls.secretName | default "keys-certs"}}

Option 2: Keep backward compatibility (and update values.yaml line 61 to match)

# In values.yaml, change line 61 to:
secretName: "apk-agent-server-cert"
🤖 Prompt for AI Agents 
In helm-charts/templates/deployment.yaml around line 109, the template default
secretName "apk-agent-server-cert" is inconsistent with values.yaml which sets
secretName "keys-certs"; update one side so both match. Either change the
template default to "keys-certs" to align with values.yaml, or change
values.yaml (line 61) to "apk-agent-server-cert" to preserve the template’s
current default; ensure the chosen value is documented and tested so deployments
using no override use the expected secret name.

6 changes: 6 additions & 0 deletions helm-charts/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,3 +56,9 @@ serviceAccount:
enableClusterRoleCreation: true
serviceAccountName: wso2agent-platform
roleName: wso2agent-role
# configs:
# tls:
# secretName: "apk-agent-tls-secret"
# certKeyFilename: "tls.key"
# certFilename: "tls.crt"
# certCAFilename: "ca.crt"