AlinsRan opened a new pull request, #1029: URL: https://github.com/apache/apisix-helm-chart/pull/1029
Fixes #970 ### What this PR does When `etcd.auth.tls.enabled` is true, the chart always renders `sni: ""` into `config.yaml`, because `etcd.auth.tls.sni` defaults to `""`. APISIX treats the empty string as a configured SNI. It never falls back to the etcd endpoint hostname, so the TLS handshake fails: ``` [lua] v3.lua:247: _request_uri(): https://etcd-01:2379: SSL_set_tlsext_host_name failed. Retrying, context: ngx.timer [lua] config_etcd.lua:191: failed to get latest revision, err: has no healthy etcd endpoint available, context: ngx.timer ``` This PR renders `sni` only when it is set, which matches the documented behavior: "the ETCD endpoint hostname will be used when this setting is unset". It also notes in the value description that `sni` must be set to a DNS name from the certificate when the etcd endpoints are IP addresses. Without it, the hostname check fails with `certificate host mismatch`, because IP SANs are not matched. This is an alternative to #808. It needs no extra toggle, and the default configuration works. ### Verification APISIX 3.16.0 against an etcd v3.5.29 with client certificate auth enabled, using `config.yaml` rendered from the chart: | etcd host | `etcd.auth.tls.sni` | before | after | |---|---|---|---| | DNS name | unset | `SSL_set_tlsext_host_name failed`, Admin API 503 | Admin API 201 | | IP | `etcd-01` (DNS SAN) | works | works | | IP | unset | `SSL_set_tlsext_host_name failed` | `certificate host mismatch` (documented) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
