deekshith-hadil opened a new issue, #2803: URL: https://github.com/apache/apisix-ingress-controller/issues/2803
## Summary We use APISIX Ingress Controller (v2.x) with CRDs for HTTP routes but need the Admin API for stream routes that require `upstream.scheme: tls`. The [upgrade guide](https://apisix.apache.org/docs/ingress-controller/upgrade-guide/#controller-only-configuration-source) states that manual Admin API changes will be overwritten on the next full sync. We need clarity on whether this applies to stream routes. ## Our Setup - APISIX 3.x (OSS) with Ingress Controller 2.x - **HTTP routes:** Managed entirely via `ApisixRoute` CRD — works fine - **Inbound stream routes (plain TCP, TLS termination):** Managed via `ApisixRoute` CRD — works fine - **Outbound stream routes (APISIX initiates TLS to upstream):** Requires `upstream.scheme: tls` — **only possible via Admin API** ## Why We Need the Admin API for Stream Routes The `ApisixRoute` CRD's stream backend has no `scheme` field: ```yaml # This is all the CRD allows for stream backends spec: stream: - name: my-route protocol: TCP match: ingressPort: 8000 backend: serviceName: my-service servicePort: 6000 ``` There is no way to specify `scheme: tls` here. We also tried: - `ApisixUpstream` CRD with `scheme: https` → ignored for stream routes (only applies to HTTP) - `ApisixUpstream` CRD with `scheme: tls` → rejected by CRD validation (not an allowed value) - Gateway API `BackendTLSPolicy` → not supported by APISIX Ingress Controller The only working approach: ```bash curl -X PUT http://admin:9180/apisix/admin/stream_routes/my-route \ -H "X-API-KEY: $KEY" \ -d '{ "server_port": 8000, "upstream": { "type": "roundrobin", "scheme": "tls", "nodes": {"upstream-server:6000": 1} } }' ``` ## Our Concern The documentation says: > Starting with APISIX Ingress Controller 2.0.0, the controller is the single source of truth. Manual Admin API changes will be overwritten on the next full sync. In our testing, stream routes created via Admin API are **not being overwritten** by the ingress controller. But we are unsure if this is guaranteed behaviour or just happens to work today. ## Questions 1. **Will stream routes created via Admin API be overwritten by the ingress controller?** Is the current behaviour (stream routes surviving full sync) intentional and stable, or could it change? 2. **Is there a plan to add `scheme` support to the `ApisixRouteStream` CRD?** This would allow us to configure outbound TLS stream routes declaratively. 3. **Can we safely use Admin API for stream routes alongside CRD-managed HTTP routes in production?** ## Use Case We use APISIX as a TCP stream proxy. For outbound connections, the upstream server requires TLS. Our clients send plain TCP to APISIX, and APISIX must initiate TLS to the upstream before forwarding the data. This requires `upstream.scheme: tls` on the stream route — which has no CRD equivalent today. ```mermaid sequenceDiagram participant Client as TCP Client participant APISIX as APISIX Gateway (Port 8000) participant Upstream as Upstream TLS Server (Port 6000) Client->>APISIX: TCP Connect (plain) APISIX->>Upstream: TLS Connect APISIX->>Upstream: TLS ClientHello Upstream->>APISIX: TLS ServerHello + Certificate Note over APISIX,Upstream: TLS session established Client->>APISIX: Data (plain TCP) APISIX->>Upstream: Data (TLS encrypted) Upstream->>APISIX: Response (TLS encrypted) APISIX->>Client: Response (plain TCP) ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
