This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new f3390e5856 fix(consul): upgrade lua-resty-consul to 0.4.0 (#14118)
f3390e5856 is described below
commit f3390e58563fc24e38db109e7e07960a09c7119c
Author: AlinsRan <[email protected]>
AuthorDate: Thu Oct 29 11:06:04 2026 +0800
fix(consul): upgrade lua-resty-consul to 0.4.0 (#14118)
---
apisix-master-0.rockspec | 2 +-
t/discovery/consul-tls.t | 104 ++++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 104 insertions(+), 2 deletions(-)
diff --git a/apisix-master-0.rockspec b/apisix-master-0.rockspec
index 441b56dd03..ee849849ef 100644
--- a/apisix-master-0.rockspec
+++ b/apisix-master-0.rockspec
@@ -70,7 +70,7 @@ dependencies = {
"argparse = 0.7.1-1",
"luasocket = 3.1.0-1",
"luasec = 1.3.2-1",
- "lua-resty-consul = 0.3-2",
+ "lua-resty-consul = 0.4-0",
"penlight = 1.14.0-3",
"ext-plugin-proto = 0.6.1-0",
"casbin = 1.46.0-1",
diff --git a/t/discovery/consul-tls.t b/t/discovery/consul-tls.t
index 3dd9308094..19faeac5c9 100644
--- a/t/discovery/consul-tls.t
+++ b/t/discovery/consul-tls.t
@@ -82,10 +82,18 @@ $ssl_verify_conf
_EOC_
}
+# the privileged agent fetches from consul in a timer after startup, so a
+# request sent right away can race the first fetch; the route waits until the
+# shared dict has the service, or up to 5 seconds when the fetch should fail
our $apisix_yaml = <<_EOC_;
routes:
-
uri: /hello
+ plugins:
+ serverless-pre-function:
+ phase: rewrite
+ functions:
+ - "return function() for _ = 1, 50 do if
ngx.shared.consul:get('default/service_tls') then return end ngx.sleep(0.1) end
end"
upstream:
service_name: service_tls
discovery_type: consul
@@ -157,6 +165,7 @@ GET /hello
qr/connect consul: https:\/\/localhost:18501\/v1 .* with error: \d+:
unable to (get local issuer|verify the first) certificate/,
qr/consul service not found: default\/service_tls/,
]
+--- timeout: 10
@@ -234,7 +243,100 @@ invalid consul server address: bad uri:
tcp://127.0.0.1:8500, the valid format:
-=== TEST 7: clean nodes
+=== TEST 7: a verifying registry does not reuse a connection another registry
opened without verification
+--- http_config
+ # the certificate of this endpoint is not signed by the trusted CA
+ lua_ssl_trusted_certificate ../../certs/mtls_ca.crt;
+
+ server {
+ listen 18502 ssl;
+ ssl_certificate ../../certs/localhost_slapd_cert.pem;
+ ssl_certificate_key ../../certs/localhost_slapd_key.pem;
+
+ location /v1/catalog/services {
+ content_by_lua_block {
+ ngx.header["Content-Type"] = "application/json"
+ ngx.header["X-Consul-Index"] = "1"
+ ngx.say('{"service_tls": []}')
+ }
+ }
+
+ location /v1/health/state/any {
+ content_by_lua_block {
+ ngx.header["Content-Type"] = "application/json"
+ ngx.header["X-Consul-Index"] = "1"
+ ngx.say('[]')
+ }
+ }
+
+ location /v1/health/service/service_tls {
+ content_by_lua_block {
+ ngx.header["Content-Type"] = "application/json"
+ ngx.header["X-Consul-Index"] = "1"
+ ngx.say('[{"Service": {"Address": "127.0.0.1", "Port":
30511}}]')
+ }
+ }
+ }
+--- yaml_config eval: main::yaml_config("https://localhost:18502";, "false",
"false")
+--- apisix_yaml
+routes: []
+#END
+--- extra_init_worker_by_lua
+ if require("ngx.process").type() ~= "privileged agent" then
+ return
+ end
+
+ -- runs in the privileged agent beside the default registry, which skips
+ -- verification and keeps its connections to localhost:18502 alive
+ ngx.timer.at(0, function()
+ local consul = require("apisix.discovery.consul")
+ for _ = 1, 30 do
+ if ngx.shared.consul:get("default/service_tls") then
+ break
+ end
+ ngx.sleep(0.1)
+ end
+
+ local reg = consul.create_registry({
+ id = "verify",
+ servers = {"https://localhost:18502"},
+ timeout = {connect = 1000, read = 1000, wait = 60},
+ weight = 1,
+ fetch_interval = 1,
+ keepalive = false,
+ ssl_verify = true,
+ })
+ consul.start_registry(reg)
+ ngx.shared.consul:set("test/verify_started", true)
+ end)
+--- config
+ location /t {
+ content_by_lua_block {
+ local dict = ngx.shared.consul
+ for _ = 1, 50 do
+ if dict:get("test/verify_started") then
+ break
+ end
+ ngx.sleep(0.1)
+ end
+ -- leave time for the first round of the verifying registry
+ ngx.sleep(1.5)
+ ngx.say("default: ", dict:get("default/service_tls") ~= nil)
+ ngx.say("verify: ", dict:get("verify/service_tls") ~= nil)
+ }
+ }
+--- request
+GET /t
+--- response_body
+default: true
+verify: false
+--- error_log eval
+qr/connect consul: https:\/\/localhost:18502\/v1 .* with error: \d+: unable to
(get local issuer|verify the first) certificate/
+--- timeout: 15
+
+
+
+=== TEST 8: clean nodes
--- config
location /v1/agent {
proxy_pass http://127.0.0.1:8500;
