viswatejan opened a new issue, #14010:
URL: https://github.com/apache/apisix/issues/14010
### Current Behavior
The `limit-req` plugin fails to resolve `$env://` and `$secret://` prefixed
environment variables in Redis configuration. Routes configured with
`redis_host: "$env://RL_REDIS_HOST"` and `redis_password:
"$env://RL_REDIS_PASSWORD"` fail with DNS resolution errors on the literal
`$env://...` string instead of resolving the environment variable.
### Root Cause
PR #13312 added central secret resolution in `plugin.filter()` that resolves
references before plugin execution. However, `limit-req` caches the Redis
connection object using `core.lrucache.plugin_ctx()`, keyed by the config
table's **identity**.
The central resolver returns a **deep copy** of the configuration
(`core.table.deepcopy(refs)`), so:
1. First request: resolved `conf` copy is cached
2. Second request: a **different** resolved `conf` copy is created
(different table identity)
3. Cache lookup fails → `create_limit_obj()` is called with a potentially
unresolved configuration
4. Unresolved `$env://` references reach Redis client initialization
### Expected Behavior
The `limit-req` plugin should resolve `$env://` and `$secret://` references
in Redis configuration before establishing the connection. Routes with
environment variable references in `redis_host` and `redis_password` should
successfully connect to Redis with the resolved values.
### Error Logs
```
[error] lua] resolver.lua:80: parse_domain(): failed to parse domain:
$env://RL_REDIS_HOST,
error: failed to query the DNS server: dns server error: 3 name error
[error] lua] redis.lua:36: new(): redis connect error, error: failed to
parse domain:
failed to query the DNS server: dns server error: 3 name error
[error] lua] limit-req.lua:171: phase_func(): failed to limit req: failed to
parse domain:
failed to query the DNS server: dns server error: 3 name error
```
### Steps to Reproduce
1. Configure APISIX with environment variables:
```bash
export RL_REDIS_HOST=localhost
export RL_REDIS_PASSWORD=test123
```
2. Create a route with `limit-req` plugin using `$env://` references:
```bash
curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H "Content-Type: application/json" \
-d '{
"uri": "/test",
"plugins": {
"limit-req": {
"count": 10,
"time_window": 60,
"key_type": "var",
"key": "remote_addr",
"policy": "redis",
"redis_host": "$env://RL_REDIS_HOST",
"redis_password": "$env://RL_REDIS_PASSWORD",
"redis_port": 6379
}
},
"upstream": {"type": "roundrobin", "nodes": {"127.0.0.1:1980": 1}}
}'
```
3. Send a request through the route:
```bash
curl http://127.0.0.1:9080/test
```
4. Check logs: observe DNS resolution error on the literal
`$env://RL_REDIS_HOST` string instead of the resolved environment variable.
### Environment
- APISIX version: 3.19.0 and later
- Operating system: Linux (all platforms)
- OpenResty / Nginx version: OpenResty 1.25+
- etcd version: N/A
- APISIX Dashboard version: N/A
- Plugin runner version: N/A
- LuaRocks version: N/A
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
