apache / apache/shenyu

[BUG] Ingress reconciler dereferences missing ingress or annotations before validation

Open
#6,491 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Current Behavior

`IngressReconciler.reconcile()` dereferences the current ingress and its annotations before checking whether the ingress still exists.

```java
final V1Ingress v1Ingress = this.ingressLister.namespace(request.getNamespace()).get(request.getName());
final V1Ingress oldIngress = IngressCache.getInstance().get(request.getNamespace(), request.getName());
Map annotations = v1Ingress.getMetadata().getAnnotations();
enablePluginsBasedOnAnnotations(annotations, request);
if (Objects.isNull(v1Ingress)) {
... delete cleanup ...
}
```

If a delete event is reconciled after the lister no longer has the ingress, `v1Ingress` is `null` and the delete cleanup branch is never reached. If the ingress exists but has no metadata annotations, `enablePluginsBasedOnAnnotations(...)` can also receive `null` before `checkIngressClass()` has a chance to accept a valid `spec.ingressClassName`-based ingress.

### Expected Behavior

The reconciler should check for a missing ingress before reading metadata, and should tolerate absent annotations for valid `networking.k8s.io/v1` ingresses that use `spec.ingressClassName`.

### Impact

Delete reconciliation can fail before removing cached selectors/rules/TLS state. Valid ingresses that specify only `spec.ingressClassName: shenyu` can fail reconciliation if annotations are absent.

### Code Location

- `shenyu-kubernetes-controller/src/main/java/org/apache/shenyu/k8s/reconciler/IngressReconciler.java`
- `reconcile()` dereferences `v1Ingress` before the null check.
- `checkIngressClass()` supports `spec.ingressClassName`, but the earlier annotation access can fail first.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with shenyu-kubernetes-controller/src/main/java/org/apache/shenyu/k8s/reconciler/IngressReconciler.java, reading reconcile() and checkIngressClass(). Trace the delete path and the annotation handling for networking.k8s.io/v1 ingresses, then run the relevant existing controller tests. Done means missing ingresses reach cleanup and valid ingressClassName-only ingresses reconcile without annotations.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kubernetes
Domain
backend, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
70/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.