Skip to content

Revert "fix: fix generating SNIs in dbless (#7853)"#7872

Merged
pmalek merged 1 commit intomainfrom
fix-sni-cert-backref
Mar 31, 2026
Merged

Revert "fix: fix generating SNIs in dbless (#7853)"#7872
pmalek merged 1 commit intomainfrom
fix-sni-cert-backref

Conversation

@pmalek
Copy link
Copy Markdown
Member

@pmalek pmalek commented Mar 31, 2026

What this PR does / why we need it:

This reverts commit 18c1423 (#7853)

This fixes an issue where Kong versions older than 3.10 would return errors when being configured with config, not containing SNI cert backreferences with IDs.

These types of configs are already accepted by versions 3.10+ (the SNI cert backreference is optional) but older versions do not allow these.

The issue with the related Kong bug is that it's only reproducible when there are consumers in the config, so:

curl -s -X POST "http://localhost:18001/config?flatten_errors=1" \
  -H "Content-Type: application/json" \
  -d '{
    "_format_version": "3.0",
    "certificates": [{
        "id": "aaaaaaaa-1111-1111-1111-111111111111",
        "cert": '"${CERT}"',
        "key": '"${KEY}"',
        "snis": [{
            "name": "test.example.com"
        }]
    }]
}' | python3 -m json.tool

does not fail with kong:3.9, but

curl -s -X POST "http://localhost:18001/config?flatten_errors=1" \
  -H "Content-Type: application/json" \
  -d '{
    "_format_version": "3.0",
    "consumers": [{
        "username": "consumer",
        "basicauth_credentials": [{
            "username": "qwerty",
            "password": "qwerty"
        }]
    }],
    "certificates": [{
        "id": "aaaaaaaa-1111-1111-1111-111111111111",
        "cert": '"${CERT}"',
        "key": '"${KEY}"',
        "snis": [{
            "name": "test.example.com"
        }]
    }]
}' | python3 -m json.tool
{
    "fields": {},
    "flattened_errors": [
        {
            "errors": [
                {
                    "message": "required field missing",
                    "type": "entity"
                }
            ],
            "entity": {
                "id": "aaaaaaaa-1111-1111-1111-111111111111"
            },
            "entity_id": "aaaaaaaa-1111-1111-1111-111111111111",
            "entity_type": "certificate"
        }
    ],
    "name": "invalid declarative configuration",
    "message": "declarative config is invalid: {}",
    "code": 14
}

Both manifests work against kong/kong-gateway 3.10+

Which issue this PR fixes:

Special notes for your reviewer:

Related kong PRs which fixed the bug but were never backported to 3.9

PR Readiness Checklist:

Complete these before marking the PR as ready to review:

  • the CHANGELOG.md release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR

@pmalek pmalek self-assigned this Mar 31, 2026
@pmalek pmalek marked this pull request as ready for review March 31, 2026 12:57
@pmalek pmalek requested a review from a team as a code owner March 31, 2026 12:57
@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 31, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.4%. Comparing base (6d6b65e) to head (3464926).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##            main   #7872     +/-   ##
=======================================
- Coverage   80.4%   78.4%   -2.0%     
=======================================
  Files        222     222             
  Lines      20964   20791    -173     
=======================================
- Hits       16862   16319    -543     
- Misses      3112    3433    +321     
- Partials     990    1039     +49     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@pmalek pmalek merged commit a5878ae into main Mar 31, 2026
56 checks passed
@pmalek pmalek deleted the fix-sni-cert-backref branch March 31, 2026 13:26
@pmalek pmalek linked an issue Mar 31, 2026 that may be closed by this pull request
team-k8s-bot pushed a commit that referenced this pull request Mar 31, 2026
This reverts commit 18c1423.

(cherry picked from commit a5878ae)
@team-k8s-bot
Copy link
Copy Markdown
Collaborator

The backport to release/3.4.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-release/3.4.x release/3.4.x
# Navigate to the new working tree
cd .worktrees/backport-release/3.4.x
# Create a new branch
git switch --create backport-7872-to-release/3.4.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a5878aead35832b692e9b71b3c906ff954bfeb70
# Push it to GitHub
git push --set-upstream origin backport-7872-to-release/3.4.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-release/3.4.x

Then, create a pull request where the base branch is release/3.4.x and the compare/head branch is backport-7872-to-release/3.4.x.

pmalek added a commit that referenced this pull request Mar 31, 2026
This reverts commit 18c1423.

(cherry picked from commit a5878ae)
pmalek added a commit that referenced this pull request Mar 31, 2026
This reverts commit 18c1423.

(cherry picked from commit a5878ae)

Co-authored-by: Patryk Małek <pmalek@users.noreply.github.com>
pmalek added a commit that referenced this pull request Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3.4.12 breaks clusters with Kong OSS (3.9)

3 participants