Report config push failures as Events

CHANGELOG.md

@@ -108,6 +108,12 @@ Adding a new version? You'll need three changes:
   that all time series for those metrics will get a new label designating the
   address of the dataplane that the configuration push has been targeted for.
   [#3521](https://github.com/Kong/kubernetes-ingress-controller/pull/3521)
+- In DB-less mode, failure to push a config will now generate Kubernetes Events
+  with the reason `KongConfigurationApplyFailed` and an `InvolvedObject`
+  indicating which Kubernetes resource was responsible for the broken Kong
+  configuration.
+  [#3446](https://github.com/Kong/kubernetes-ingress-controller/pull/3446)
+
 
 ### Fixed
 

internal/dataplane/kong_client.go

@@ -502,15 +502,18 @@ func (c *KongClient) sendToClient(
 	// apply the configuration update in Kong
 	timedCtx, cancel := context.WithTimeout(ctx, c.requestTimeout)
 	defer cancel()
-	newConfigSHA, err := sendconfig.PerformUpdate(
+	newConfigSHA, entityErrors, err := sendconfig.PerformUpdate(
 		timedCtx,
 		logger,
 		client,
 		config,
 		targetConfig,
 		c.prometheusMetrics,
 	)
+
+	c.recordResourceFailureEvents(entityErrors, KongConfigurationApplyFailedEventReason)
 	sendDiagnostic(err != nil)
+
 	if err != nil {
 		if expired, ok := timedCtx.Deadline(); ok && time.Now().After(expired) {
 			logger.Warn("exceeded Kong API timeout, consider increasing --proxy-timeout-seconds")

internal/dataplane/kongstate/consumer.go

@@ -66,43 +66,49 @@ func (c *Consumer) SanitizedCopy() *Consumer {
 	}
 }
 
-func (c *Consumer) SetCredential(credType string, credConfig interface{}) error {
+func (c *Consumer) SetCredential(credType string, credConfig interface{}, tags []*string) error {
 	switch credType {
 	case "key-auth", "keyauth_credential":
 		cred, err := NewKeyAuth(credConfig)
 		if err != nil {
 			return err
 		}
+		cred.Tags = tags
 		c.KeyAuths = append(c.KeyAuths, cred)
 	case "basic-auth", "basicauth_credential":
 		cred, err := NewBasicAuth(credConfig)
 		if err != nil {
 			return err
 		}
+		cred.Tags = tags
 		c.BasicAuths = append(c.BasicAuths, cred)
 	case "hmac-auth", "hmacauth_credential":
 		cred, err := NewHMACAuth(credConfig)
 		if err != nil {
 			return err
 		}
+		cred.Tags = tags
 		c.HMACAuths = append(c.HMACAuths, cred)
 	case "oauth2":
 		cred, err := NewOauth2Credential(credConfig)
 		if err != nil {
 			return err
 		}
+		cred.Tags = tags
 		c.Oauth2Creds = append(c.Oauth2Creds, cred)
 	case "jwt", "jwt_secret":
 		cred, err := NewJWTAuth(credConfig)
 		if err != nil {
 			return err
 		}
+		cred.Tags = tags
 		c.JWTAuths = append(c.JWTAuths, cred)
 	case "acl":
 		cred, err := NewACLGroup(credConfig)
 		if err != nil {
 			return err
 		}
+		cred.Tags = tags
 		c.ACLGroups = append(c.ACLGroups, cred)
 	case "mtls-auth":
 		if !versions.GetKongVersion().MajorMinorPatchOnly().GTE(versions.MTLSCredentialVersionCutoff) {
@@ -112,6 +118,7 @@ func (c *Consumer) SetCredential(credType string, credConfig interface{}) error
 		if err != nil {
 			return err
 		}
+		cred.Tags = tags
 		c.MTLSAuths = append(c.MTLSAuths, cred)
 	default:
 		return fmt.Errorf("invalid credential type: '%v'", credType)