jjansenvr commented on issue #14038:
URL: https://github.com/apache/apisix/issues/14038#issuecomment-6186589710
I currently use a "monkey patch" that parses the yml file before filling in
the environment variables
The original code fills in environment variables before the YAML is parsed.
The patch parses the YAML first and fills them in afterwards.
### Before the patch:
- resolve_conf_var_in_text(raw_config) replaces each ${{VAR}} in the raw
text of apisix.yaml, and only then runs yaml.load. A multiline value such as a
PEM certificate lands in the file text unindented:
```
ssls:
- cert: -----BEGIN CERTIFICATE-----
MIIBxTCCAWugAwIBAgIU...
-----END CERTIFICATE-----
```
### After the patch:
- yaml.load(raw_config) parses the file while it still contains cert:
${{SERVER_CRT}}, which is a plain one-line string.
file.resolve_conf_var(resolved) goes through the parsed table and replaces
${{VAR}} inside the string values.
- A certificate's newlines end up inside a single string value, so they can
no longer affect the YAML structure.
- The second sed swaps return yaml.load(resolved), nil for return resolved,
nil, because the config has already been parsed by then. If resolving fails,
resolved is set to nil, so the error is passed on as it was before.
## Patch inconfig_yaml.lua (I added to my dockerfile)
`
USER root
RUN set -eux; \
f=/usr/local/apisix/apisix/core/config_yaml.lua; \
sed -i \
-e 's|local resolved, err =
file.resolve_conf_var_in_text(raw_config)|local resolved =
yaml.load(raw_config); local ok, err = file.resolve_conf_var(resolved or {});
if not ok then resolved = nil end|' \
-e 's|return yaml.load(resolved), nil|return resolved, nil|' \
"$f"; \
grep -q 'file.resolve_conf_var(resolved or {})' "$f"; \
grep -q 'return resolved, nil' "$f"; \
! grep -q 'resolve_conf_var_in_text(raw_config)' "$f"
USER apisix
`
## SIDE effects of the patch
| Config | Env value | Old (substitute in text, then parse) | New (patch) |
|---|---|---|---|
| `status: ${{STATUS}}` | `1` | number `1` | number `1` ✅ |
| `enabled: ${{BOOL}}` | `true` | boolean | boolean ✅ |
| `ratio: ${{FLOAT}}` | `0.5` | number | number ✅ |
| `quoted_status: "${{STATUS}}"` | `1` | string `"1"` | number `1` ⚠️ |
| `list: ${{LIST}}` | `[a, b]` | list | string ⚠️ |
| `nullish: ${{NULLV}}` | `null` | null | string `"null"` ⚠️ |
| `cert: "${{CERT}}"` | multiline PEM | broken | string ✅ |
For example, `key: "${{API_KEY}}"` with `API_KEY=12345` could now fail
schema validation on a string field.
We previously used a patch from @boekkooi-lengoo wich stopped working after
APISIX 3.16
https://github.com/apache/apisix/issues/7223#issuecomment-1380123833
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
