Report config push failures as Events

CHANGELOG.md

@@ -115,6 +115,11 @@ Adding a new version? You'll need three changes:
  that all time series for those metrics will get a new label designating the
  address of the dataplane that the configuration push has been targeted for.
  [#3521](https:/Kong/kubernetes-ingress-controller/pull/3521)
+- In DB-less mode, failure to push a config will now generate Kubernetes Events
+ with the reason `KongConfigurationApplyFailed` and an `InvolvedObject`
+ indicating which Kubernetes resource was responsible for the broken Kong
+ configuration.
+ [#3446](https:/Kong/kubernetes-ingress-controller/pull/3446)
 - Leader election is enabled by default then kong admin service discovery is enabled.
  [#3529](https:/Kong/kubernetes-ingress-controller/pull/3529)
 

internal/dataplane/kong_client.go

@@ -487,15 +487,18 @@ func (c *KongClient) sendToClient(
  // apply the configuration update in Kong
  timedCtx, cancel := context.WithTimeout(ctx, c.requestTimeout)
  defer cancel()
- newConfigSHA, err := sendconfig.PerformUpdate(
+ newConfigSHA, entityErrors, err := sendconfig.PerformUpdate(
  timedCtx,
  logger,
  client,
  config,
  targetConfig,
  c.prometheusMetrics,
  )
+
+ c.recordResourceFailureEvents(entityErrors, KongConfigurationApplyFailedEventReason)
  sendDiagnostic(err != nil)
+
  if err != nil {
  if expired, ok := timedCtx.Deadline(); ok && time.Now().After(expired) {
  logger.Warn("exceeded Kong API timeout, consider increasing --proxy-timeout-seconds")

internal/dataplane/kongstate/consumer.go

@@ -66,43 +66,49 @@ func (c *Consumer) SanitizedCopy() *Consumer {
  }
 }
 
-func (c *Consumer) SetCredential(credType string, credConfig interface{}) error {
+func (c *Consumer) SetCredential(credType string, credConfig interface{}, tags []*string) error {
  switch credType {
  case "key-auth", "keyauth_credential":
  cred, err := NewKeyAuth(credConfig)
  if err != nil {
  return err
  }
+ cred.Tags = tags
  c.KeyAuths = append(c.KeyAuths, cred)
  case "basic-auth", "basicauth_credential":
  cred, err := NewBasicAuth(credConfig)
  if err != nil {
  return err
  }
+ cred.Tags = tags
  c.BasicAuths = append(c.BasicAuths, cred)
  case "hmac-auth", "hmacauth_credential":
  cred, err := NewHMACAuth(credConfig)
  if err != nil {
  return err
  }
+ cred.Tags = tags
  c.HMACAuths = append(c.HMACAuths, cred)
  case "oauth2":
  cred, err := NewOauth2Credential(credConfig)
  if err != nil {
  return err
  }
+ cred.Tags = tags
  c.Oauth2Creds = append(c.Oauth2Creds, cred)
  case "jwt", "jwt_secret":
  cred, err := NewJWTAuth(credConfig)
  if err != nil {
  return err
  }
+ cred.Tags = tags
  c.JWTAuths = append(c.JWTAuths, cred)
  case "acl":
  cred, err := NewACLGroup(credConfig)
  if err != nil {
  return err
  }
+ cred.Tags = tags
  c.ACLGroups = append(c.ACLGroups, cred)
  case "mtls-auth":
  if !versions.GetKongVersion().MajorMinorPatchOnly().GTE(versions.MTLSCredentialVersionCutoff) {
@@ -112,6 +118,7 @@ func (c *Consumer) SetCredential(credType string, credConfig interface{}) error
  if err != nil {
  return err
  }
+ cred.Tags = tags
  c.MTLSAuths = append(c.MTLSAuths, cred)
  default:
  return fmt.Errorf("invalid credential type: '%v'", credType)