Secret updates/deletes only trigger DAG rebuilds if referenced

[skriss]

On Secret updates and deletes, only
trigger DAG rebuilds if the Secret
is referenced by an Ingress, HTTPProxy,
Gateway or global config.

Closes #4386.

Signed-off-by: Steve Kriss krisss@vmware.com

[skriss]

This is at least partly covered by existing tests, but I'll take another look to see if coverage should be improved anywhere.

[codecov]

Codecov Report

Merging #4792 (fa52ad0) into main (ec00824) will increase coverage by 0.04%.
The diff coverage is 91.48%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4792      +/-   ##
==========================================
+ Coverage   76.16%   76.20%   +0.04%     
==========================================
  Files         140      140              
  Lines       16914    16920       +6     
==========================================
+ Hits        12882    12894      +12     
+ Misses       3780     3776       -4     
+ Partials      252      250       -2     

Impacted Files	Coverage Δ
internal/dag/dag.go	96.62% <ø> (ø)
internal/dag/cache.go	92.37% <85.36%> (+0.88%)	⬆️
internal/dag/secret.go	75.62% <95.45%> (+1.23%)	⬆️
internal/dag/extension_processor.go	95.79% <100.00%> (ø)
internal/dag/gatewayapi_processor.go	94.72% <100.00%> (ø)
internal/dag/httpproxy_processor.go	93.20% <100.00%> (ø)
internal/dag/ingress_processor.go	97.07% <100.00%> (ø)

[sunjayBhatia]

This is at least partly covered by existing tests, but I'll take another look to see if coverage should be improved anywhere.

yeah i think there is a featuretest that unrelated secret additions dont cause config version changes, might be good to test removal of an unreferenced secret doesnt cause a dag build etc. for some more coverage:

contour/internal/featuretests/v3/secrets_test.go

Lines 162 to 176 in 0467b84

	// s2 is not referenced by any active ingress object.
	s2 := &v1.Secret{
	ObjectMeta: metav1.ObjectMeta{
	Name: "unrelated",
	Namespace: "default",
	},
	Type: "kubernetes.io/tls",
	Data: s1.Data,
	}
	rh.OnAdd(s2)
	c.Request(secretType).Equals(&envoy_discovery_v3.DiscoveryResponse{
	Resources: resources(t, secret(s1)),
	})
	assertEqualVersion(t, "2", res)

[skriss]

@sunjayBhatia good call, added to that test and also found/fixed some bugs in that test that were resulting in it not testing what we thought it was 😅