jjansenvr opened a new issue, #14038:
URL: https://github.com/apache/apisix/issues/14038
### Current Behavior
### Environment variable substitution: `apisix.yaml` vs `apisix.json`
(APISIX 3.19.0)
In standalone mode, `apisix.yaml` substitutes `${{VAR}}` in the raw text
*before* parsing (`resolve_conf_var_in_text`), while `apisix.json` parses first
and substitutes afterwards (`resolve_conf_var`). As a result, the same
environment variable produces different values depending on the config format,
and multiline values (such as PEM certificates) cannot be used in YAML at all.
| env value | `apisix.yaml` unquoted<br>`key: ${{VAR}}` | `apisix.yaml`
quoted<br>`key: "${{VAR}}"` | `apisix.json`<br>`"key": "${{VAR}}"` |
|---|---|---|---|
| `1` | number `1` | string `"1"` | number `1` |
| `true` | boolean `true` | string `"true"` | boolean `true` |
| `0123` | number `83` (YAML octal) | string `"0123"` | number `123` |
| multiline PEM certificate | ❌ parse error: `could not find expected ':'` |
❌ string with newlines folded into spaces:<br>`"-----BEGIN CERTIFICATE-----
MIID -----END CERTIFICATE-----"` | ✅ string with newlines preserved |
A YAML block scalar (`key: |` followed by `${{VAR}}` on the next line) does
not help either: only the first line of the substituted value is indented, so
parsing fails with `could not find expected ':'`.
#### Impact
- A multiline certificate/key can be injected via an environment variable in
`apisix.json`, but not in `apisix.yaml`.
- With the quoted form, startup succeeds but the SSL object is rejected at
runtime:
`failed to check item data of [ssls] err:failed to parse cert:
PEM_read_bio_X509_AUX() failed`
- With the unquoted form, `apisix init` fails during the `apisix.yaml`
validation in `apisix/cli/file.lua`, so APISIX does not start.
### Expected Behavior
I would expect the same behavior in a json as a yml config.
### Error Logs
_No response_
### Steps to Reproduce
#### Reproduce
`apisix.yaml`:
ssls:
- id: 1
snis: ["localhost"]
cert: "${{SERVER_CERT}}"
key: "${{SERVER_KEY}}"
#END
Start APISIX 3.19.0 in standalone mode with `SERVER_CERT` / `SERVER_KEY` set
to PEM values (containing newlines). The same values work when the config is
supplied as `apisix.json`.
### Environment
- APISIX version
"apache/apisix:3.19.0-ubuntu"
- Operating system (run `uname -a`):
Linux 93218b89679c 5.15.146.1-microsoft-standard-WSL2 #1 SMP Thu Jan 11
04:09:03 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
nginx version: openresty/1.29.2.4
- etcd version, if relevant (run `curl
http://127.0.0.1:9090/v1/server_info`):
standalone mode
- APISIX Dashboard version, if relevant:
n/a
- Plugin runner version, for issues related to plugin runners:
n/a
- LuaRocks version, for installation issues (run `luarocks --version`):
/usr/bin/luarocks 3.8.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
