add lookup tag

cmd/common.go

@@ -238,6 +238,24 @@ func syncMain(ctx context.Context, filenames []string, dry bool, parallelism,
 		return err
 	}
 
+	dumpConfig.LookUpSelectorTagsConsumers, err = determineLookUpSelectorTagsConsumers(*targetContent)
+	if err != nil {
+		return fmt.Errorf("error determining lookup selector tags: %w", err)
+	}
+
+	if dumpConfig.LookUpSelectorTagsConsumers != nil {
+		consumersGlobal, err := dump.GetAllConsumers(ctx, kongClient, dumpConfig.LookUpSelectorTagsConsumers)
+		if err != nil {
+			return fmt.Errorf("error retrieving global consumers via lookup selector tags: %w", err)
+		}
+		for _, c := range consumersGlobal {
+			targetContent.Consumers = append(targetContent.Consumers, file.FConsumer{Consumer: *c})
+			if err != nil {
+				return fmt.Errorf("error adding global consumer %v: %w", *c.Username, err)
+			}
+		}
+	}
+
 	if utils.Kong340Version.LTE(parsedKongVersion) {
 		dumpConfig.IsConsumerGroupScopedPluginSupported = true
 	}
@@ -321,6 +339,21 @@ func syncMain(ctx context.Context, filenames []string, dry bool, parallelism,
 	return nil
 }
 
+func determineLookUpSelectorTagsConsumers(targetContent file.Content) ([]string, error) {
+	if targetContent.Info != nil &&
+		targetContent.Info.LookUpSelectorTags != nil &&
+		targetContent.Info.LookUpSelectorTags.Consumers != nil {
+		if len(targetContent.Info.LookUpSelectorTags.Consumers) == 0 {
+			return nil, fmt.Errorf("global consumers specified but no global tags")
+		}
+		utils.RemoveDuplicates(&targetContent.Info.LookUpSelectorTags.Consumers)
+		sort.Strings(targetContent.Info.LookUpSelectorTags.Consumers)
+		return targetContent.Info.LookUpSelectorTags.Consumers, nil
+
+	}
+	return nil, nil
+}
+
 func determineSelectorTag(targetContent file.Content, config dump.Config) ([]string, error) {
 	if targetContent.Info != nil {
 		if len(targetContent.Info.SelectorTags) > 0 {

cmd/gateway_validate.go

@@ -47,6 +47,25 @@ func executeValidate(cmd *cobra.Command, _ []string) error {
 		if err != nil {
 			return err
 		}
+
+		// if this is an online validation, we need to look up upstream consumers if required.
+		lookUpSelectorTagsConsumers, err := determineLookUpSelectorTagsConsumers(*targetContent)
+		if err != nil {
+			return fmt.Errorf("error determining lookup selector tags: %w", err)
+		}
+
+		if lookUpSelectorTagsConsumers != nil {
+			consumersGlobal, err := dump.GetAllConsumers(ctx, kongClient, lookUpSelectorTagsConsumers)
+			if err != nil {
+				return fmt.Errorf("error retrieving global consumers via lookup selector tags: %w", err)
+			}
+			for _, c := range consumersGlobal {
+				targetContent.Consumers = append(targetContent.Consumers, file.FConsumer{Consumer: *c})
+				if err != nil {
+					return fmt.Errorf("error adding global consumer %v: %w", *c.Username, err)
+				}
+			}
+		}
 	}
 
 	rawState, err := file.Get(ctx, targetContent, file.RenderConfig{

tests/integration/sync_test.go

@@ -4715,6 +4715,44 @@ func Test_Sync_DoNotUpdateCreatedAt(t *testing.T) {
 	// consumers do not have an updated_at field
 }
 
+// Test_Sync_LookupConsumerTags tests that existing behavior when referencing
+// consumers from plugins is preserved:
+// - if a referenced consumer is not present in the state file, the sync fails
+// - if a referenced consumer is present in the state file, the sync succeeds
+//
+// This test also tests that the new behavior is implemented correctly:
+//   - if a referenced consumer is not present in the state file, but is present
+//     in Kong when using the new lookup selector tags, the sync succeeds
+//   - if a referenced consumer is not present in the state file and neither in
+//     Kong when using the new lookup selector tags, the sync fails
+func Test_Sync_LookupConsumerTags(t *testing.T) {
+	runWhen(t, "enterprise", ">=3.0.0")
+	setup(t)
+
+	// test that reference to non-existing consumer fails.
+	pluginsNoLookupStateFile := "testdata/sync/028-lookup-tags/plugins_no_lookup.yaml"
+	err := sync(pluginsNoLookupStateFile)
+	require.Error(t, err)
+	require.EqualError(t, err, "building state: consumer foo for plugin rate-limiting-advanced: entity not found")
+
+	// test that reference to existing local consumer succeeds.
+	pluginsAndConsumersStateFile := "testdata/sync/028-lookup-tags/plugins_and_consumers.yaml"
+	require.NoError(t, sync(pluginsAndConsumersStateFile))
+	reset(t)
+
+	// test that reference to existing global consumer succeeds via lookup tags.
+	globalConsumersStateFile := "testdata/sync/028-lookup-tags/global_consumers.yaml"
+	require.NoError(t, sync(globalConsumersStateFile))
+	// sync plugins with lookup reference to global consumers.
+	pluginsLookupStateFile := "testdata/sync/028-lookup-tags/plugins_lookup.yaml"
+	require.NoError(t, sync(pluginsLookupStateFile))
+	reset(t)
+
+	// test that reference to non-existing global consumer fails via lookup tags.
+	require.Error(t, sync(pluginsLookupStateFile))
+	require.EqualError(t, err, "building state: consumer foo for plugin rate-limiting-advanced: entity not found")
+}
+
 // test scope:
 //   - 3.0.0+
 //   - konnect

tests/integration/testdata/sync/029-lookup-tags/global_consumers.yaml

@@ -0,0 +1,6 @@
+_format_version: "3.0"
+_info:
+  select_tags:
+  - global-consumers
+consumers:
+- username: foo

tests/integration/testdata/sync/029-lookup-tags/plugins_and_consumers.yaml

@@ -0,0 +1,13 @@
+_format_version: "3.0"
+plugins:
+- name: rate-limiting-advanced
+  config:
+    limit:
+    - 10
+    window_size:
+    - 60
+    namespace: foo
+    sync_rate: -1
+  consumer: foo
+consumers:
+- username: foo

tests/integration/testdata/sync/029-lookup-tags/plugins_lookup.yaml

@@ -0,0 +1,17 @@
+_format_version: "3.0"
+_info:
+  select_tags:
+  - managed-by-deck
+  default_lookup_tags:
+    consumers:
+    - global-consumers
+plugins:
+- name: rate-limiting-advanced
+  config:
+    limit:
+    - 10
+    window_size:
+    - 60
+    namespace: foo
+    sync_rate: -1
+  consumer: foo

tests/integration/testdata/sync/029-lookup-tags/plugins_no_lookup.yaml

@@ -0,0 +1,14 @@
+_format_version: "3.0"
+_info:
+  select_tags:
+  - managed-by-deck
+plugins:
+- name: rate-limiting-advanced
+  config:
+    limit:
+    - 10
+    window_size:
+    - 60
+    namespace: foo
+    sync_rate: -1
+  consumer: foo