bhuvan-somisetty opened a new pull request, #14117: URL: https://github.com/apache/apisix/pull/14117
### Description When a stream route uses the `traffic-split` plugin with an inline upstream (specifying `scheme: "tls"` or upstream client certificates for mTLS), `apisix/upstream.lua` short-circuited `_M.set_by_route` by returning `set_http_upstream_tls(api_ctx, api_ctx.upstream_conf)`. Because `set_http_upstream_tls` only handles HTTP schemes (`https` and `grpcs`), in the stream subsystem this skipped all stream upstream initialization: 1. `fill_node_info(up_conf, nil, true)` was never executed for the inline upstream. 2. `set_stream_upstream_tls()` was never called, causing APISIX to attempt a plaintext TCP connection against the upstream TLS server. 3. Upstream SNI (`ngx_var.upstream_sni`) and mTLS client certificates (`set_stream_upstream_client_cert`) were bypassed. This PR refactors the stream upstream initialization logic into `set_stream_upstream` and invokes it when `api_ctx.upstream_conf` is present in the stream subsystem. #### Which issue(s) this PR fixes: Fixes #14116 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
