nic-6443 opened a new pull request, #14054: URL: https://github.com/apache/apisix/pull/14054
### Description The `tls` settings of an inline `weighted_upstreams[].upstream` in `traffic-split` are ignored: a client certificate is never sent, and `tls.verify` / `tls.ca_certs` have no effect. There were three gaps: - `set_upstream` in `traffic-split` builds the upstream from a fixed field list that didn't include `tls`. - `set_by_route` returns early when traffic-split has already set `upstream_conf`, so the code that applies `tls.verify`, `tls.ca_certs` and the client certificate never ran for that upstream. That code is now a local function used by both paths. - `tls.client_cert_id` was always resolved from the route's upstream (`matched_upstream`), not from the inline upstream traffic-split picked. This only covers `tls`. Other fields like `keepalive_pool` are still not carried over by traffic-split. The docs now list `tls` as a supported field of the inline upstream. New tests in `t/plugin/traffic-split5.t` cover `client_cert`/`client_key`, `client_cert_id` and `verify` + `ca_certs` on an inline upstream. Without the fix the first two get a 400 from the upstream (no client certificate) and the third gets a 200 instead of a verification failure. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
