nic-6443 opened a new pull request, #13833:
URL: https://github.com/apache/apisix/pull/13833
### Description
A stream route takes the same upstream schema as an HTTP one,
`tls.client_cert`/`tls.client_key` included. `routes`, `services` and
`upstreams` all register an `encrypt_conf` hook that runs
`apisix_upstream.encrypt_conf()` before the write, so an inline client key is
encrypted at rest; `stream_routes` never registered one, so the same key sent
to `/apisix/admin/stream_routes/{id}` is stored in etcd verbatim and returned
in plaintext by the Admin API.
This registers the hook for `stream_routes` as well. Keys written before the
change keep working — `aes_decrypt_pkey()` passes a PEM through untouched — and
the new entry in `t/admin/stream-routes.t` asserts both that etcd no longer
holds the plaintext and that the Admin API no longer returns it.
#### Which issue(s) this PR fixes:
N/A
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change — the
encryption of inline upstream keys is already documented for the other resources
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
