Kong / deck

decK: Configuration management and drift detection for Kong
https://docs.konghq.com/deck/overview
Apache License 2.0
438 stars 128 forks source link

Deck sees blacklist/whitelist in plugins as diffs when run against Kong 2.X #1258

Open gchristidis opened 7 months ago

gchristidis commented 7 months ago

We are upgrading Kong from 2.0 to 2.8, i know its still old but its a required step before we can upgrade to Kong 3 as Kong requires 2.1 min to upgrade.

Kong 2.1 changed plugins acl, ip-restriction & bot-detection to use allow/deny field but still supported the old whitelist/blacklist fields , they are converted to allow/deny on import.

Deck will sync configs with whitelist/blacklist as Kong converts them, but when running a diff it shows them as drifts.

Using deck 1.36.1 and Kong 2.8 and a config file

plugins:
  - name: acl
    config:
      blacklist: null
      whitelist:
      - sdk-consumers

Running deck gateway sync results in

creating plugin acl (global)
Summary:
  Created: 1
  Updated: 0
  Deleted: 0

Now running a deck gateway diff results in the following drift

updating plugin acl (global)  {
   "config": {
-    "allow": [
-      "sdk-consumers"
-    ],
+    "allow": null,
     "deny": null,
     "hide_groups_header": false
+    "blacklist": null
+    "whitelist": [
+      "sdk-consumers"
+    ]
   },
   "enabled": true,
   "id": "5fe48c16-5e63-4189-bcfb-a72d3b72b04c",
   "name": "acl",
   "protocols": [
     "grpc",
     "grpcs",
     "http",
     "https"
   ]
 }

Summary:
  Created: 0
  Updated: 1
  Deleted: 0

I looked at the possibility of using default to fix this but plugins dont support defaults according to the docs..

mheap commented 1 month ago

@gchristidis We made some changes to default filling in deck 1.40.0 - could you test if it's still an issue?