feat: Allow use of config maps and secrets in plugin configs

[jnystad]

Hi there,

Some plugins require secrets in their configs (e.g. openid-connect with client_secret and session.secret), but there is no way of injecting this from a Kubernetes secret that I can see. Likewise, obtaining some values from config maps could be very useful.

This makes it hard to automate deployments when using apisix-ingress-controller without writing custom scripts to inject secrets at deploy time (which is not always possible or desirable, e.g. when using a Kustomize based workflow with standard tooling like ArgoCD).

Is there a plan to add support for this? For instance, with a preprocessing step of plugin configs or adding the option to refer to a config map/value or secret/value in any of the config values?

[tao12345666333]

Do you want something similar to what we did with ApisixConsumer? With a secretRef item

apisix-ingress-controller/test/e2e/suite-plugins/suite-plugins-authentication/jwt.go

Lines 139 to 147 in b734af3

	apiVersion: apisix.apache.org/v2beta3
	kind: ApisixConsumer
	metadata:
	name: foo
	spec:
	authParameter:
	jwtAuth:
	secretRef:
	name: jwt

[jnystad]

Yes, please. And if you include the option to set secret key name as well, that would probably solve the most common use cases.

[An-DJ]

I'd want to help to solve this. Could it be assigned to me? @tao12345666333

[tao12345666333]

@jnystad #1486 has been merged. It will be introduced in v1.6 version (this week)