[GitHub] [apisix-ingress-controller] tokers commented on issue #521: docs: update mTLS support in ApisixTls reference
tokers commented on issue #521: URL: https://github.com/apache/apisix-ingress-controller/issues/521#issuecomment-864357342 > @gxthrj Please set milestone for this issue. > > > > /milestone v1.1 Done. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] tokers commented on issue #468: bug: report scheme error when event record
tokers commented on issue #468: URL: https://github.com/apache/apisix-ingress-controller/issues/468#issuecomment-864357297 > @gxthrj Please set milestone for this issue > > > > /milestone v1.1 Done. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] tokers commented on issue #464: bug: endpoint controller sync changes failed
tokers commented on issue #464: URL: https://github.com/apache/apisix-ingress-controller/issues/464#issuecomment-864357232 @flying1pig Please provide a reproducible minimal case. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] tao12345666333 commented on issue #464: bug: endpoint controller sync changes failed
tao12345666333 commented on issue #464: URL: https://github.com/apache/apisix-ingress-controller/issues/464#issuecomment-864348809 We have released v1.0 version, can you try again? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] tao12345666333 commented on issue #468: bug: report scheme error when event record
tao12345666333 commented on issue #468: URL: https://github.com/apache/apisix-ingress-controller/issues/468#issuecomment-864348703 @gxthrj Please set milestone for this issue /milestone v1.1 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] tao12345666333 commented on issue #521: docs: update mTLS support in ApisixTls reference
tao12345666333 commented on issue #521: URL: https://github.com/apache/apisix-ingress-controller/issues/521#issuecomment-864348507 @gxthrj Please set milestone for this issue. /milestone v1.1 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] tao12345666333 commented on issue #538: Failed to watch *v1.Ingress to watch *v2alpha1.ApisixClusterConfig
tao12345666333 commented on issue #538: URL: https://github.com/apache/apisix-ingress-controller/issues/538#issuecomment-864348309 @kingGang you can try to clone this repo https://github.com/apache/apisix-helm-chart and run helm install. thanks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] tao12345666333 commented on issue #423: bug: ingress routing resource manifest file does not take effect 路由的资源清单文件不生效
tao12345666333 commented on issue #423: URL: https://github.com/apache/apisix-ingress-controller/issues/423#issuecomment-864348074 @Marco-Zheng any update? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] gxthrj closed issue #286: Proposal: Need to block the ip and id that appear in the declarative configuration
gxthrj closed issue #286: URL: https://github.com/apache/apisix-ingress-controller/issues/286 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] gxthrj commented on issue #60: We may need debounce mechanism to collapse Kubernetes events
gxthrj commented on issue #60: URL: https://github.com/apache/apisix-ingress-controller/issues/60#issuecomment-864347208 stale issue, feel free to reopen . -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] gxthrj closed issue #60: We may need debounce mechanism to collapse Kubernetes events
gxthrj closed issue #60: URL: https://github.com/apache/apisix-ingress-controller/issues/60 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] gxthrj closed issue #287: bug: lease election error
gxthrj closed issue #287: URL: https://github.com/apache/apisix-ingress-controller/issues/287 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] gxthrj closed issue #447: bug: fatal error reported when run `make build` in release src
gxthrj closed issue #447: URL: https://github.com/apache/apisix-ingress-controller/issues/447 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] gxthrj closed issue #455: feat: ApisixClusterConfig status recording
gxthrj closed issue #455: URL: https://github.com/apache/apisix-ingress-controller/issues/455 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-ingress-controller] gxthrj opened a new issue #548: feat: Integrate cert-manager to manage secrets
gxthrj opened a new issue #548: URL: https://github.com/apache/apisix-ingress-controller/issues/548 Use [cert-manager](https://cert-manager.io/) to manager secrets, so we can dynamically update certificates, such as SSL certificates. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] juzhiyuan merged pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
juzhiyuan merged pull request #371: URL: https://github.com/apache/apisix-website/pull/371 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[apisix-website] branch master updated: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog (#371)
This is an automated email from the ASF dual-hosted git repository. juzhiyuan pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/apisix-website.git The following commit(s) were added to refs/heads/master by this push: new b728df4 docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog (#371) b728df4 is described below commit b728df494eae17b0c83d29fdcf33168956fd0fc9 Author: Serendipity96 AuthorDate: Sat Jun 19 10:46:12 2021 +0800 docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog (#371) Co-authored-by: juzhiyuan --- ...of-Apache-APISIX-Ingress-Controller-released.md | 96 + website/static/img/blog_img/2021-06-18-1.png | Bin 0 -> 296877 bytes 2 files changed, 96 insertions(+) diff --git a/website/blog/2021-06-18-first-GA-version-v1.0-of-Apache-APISIX-Ingress-Controller-released.md b/website/blog/2021-06-18-first-GA-version-v1.0-of-Apache-APISIX-Ingress-Controller-released.md new file mode 100644 index 000..b18e3fd --- /dev/null +++ b/website/blog/2021-06-18-first-GA-version-v1.0-of-Apache-APISIX-Ingress-Controller-released.md @@ -0,0 +1,96 @@ +--- +title: "Apache APISIX Ingress Controller 首个 GA 版本 v1.0 正式发布！" +author: Jintao Zhang +authorURL: "https://github.com/tao12345666333; +authorImageURL: "https://avatars.githubusercontent.com/u/3264292?v=4; +--- + +> [@tao12345666333](https://github.com/tao12345666333), Apache APISIX commiter from [Shenzhen Zhiliu Technology Co.](https://www.apiseven.com/) + +### 关于 Apache APISIX Ingress Controller + +Apache APISIX Ingress Controller 是一个使用 Apache APISIX 作为数据面承载流量的云原生 Ingress Controller 实现，采用 CRD 的方式对 Kubernetes 进行了扩展。 + + + +可支持使用包括 ApisixRoute、ApisixUpstream 等自定义资源，以及 Kubernetes 原生 Ingress 资源等控制外部流量访问部署在 Kubernetes 中的服务。 + +整体架构如下： + + + +### v1.0 最新特性 + + 增加 ApisixConsumer 自定义资源使配置认证更方便 + +在之前的版本中，如果想要配置 keyAuth 或者 basicAuth 需要手动去调用 Apache APISIX 的 admin api 创建 consumer 配置。 + +在 v1.0 版本中，我们增加了 `ApisixConsumer` 资源，用户可以使用更原生的方式来定义 consumer 资源及为 ApisixRoute 配置认证。 + +例如通过以下配置定义一个 keyAuth 资源： + +```yaml +apiVersion: apisix.apache.org/v2alpha1 +kind: ApisixConsumer +metadata: + name: keyauth +spec: + authParameter: +keyAuth: + value: +key: API +``` + +在 ApisixRoute 中只需要增加对应类型的 `authentication` 配置即可。 + +```yaml +apiVersion: apisix.apache.org/v2alpha1 +kind: ApisixRoute +metadata: + name: httpbin-route +spec: + http: + ... + authentication: + enable: true + type: keyAuth +``` + + 为 ApisixTls 增加 mTLS 支持 + +在 v1.0 版本中我们也为 ApisixTls 自定义资源增加了 mTLS 的支持，只需要在 ApisixTls 资源的配置中增加 client 配置即可，例如： + +```yaml +apiVersion: apisix.apache.org/v1 +kind: ApisixTls +metadata: + name: sample-tls +spec: + ... + client: +caSecret: + name: client-ca-secret + namespace: default +``` + + 为原生 Ingress 资源增加了更多 annotation 来丰富其功能 + +- `k8s.apisix.apache.org/blocklist-source-range` 可对来源 IP 进行限制； +- `k8s.apisix.apache.org/rewrite-target` 和 `k8s.apisix.apache.org/rewrite-target-regex` 可进行 target 的 rewrite 操作； +- `k8s.apisix.apache.org/http-to-https` 可进行 HTTP 到 HTTPS 的强制重定向； + +更多特性变更请参考项目 [CHANGELOG](https://github.com/apache/apisix-ingress-controller/blob/master/CHANGELOG.md) 。 + +### 为什么使用 APISIX Ingress Controller + +Apache APISIX Ingress Controller 使用 Apache APISIX 作为其数据面承载业务流量，所以其从 Apache APISIX 继承了如下优势： + +- **高性能 & 稳定性**：Apache APISIX 是一款云原生高性能动态 API 网关，已在众多企业大规模流量场景下使用，其性能及稳定性久经考验。 +- **生态丰富**：Apache APISIX 是当前最活跃的开源网关项目，作为 Apache 顶级项目，无论是社区活跃度还是其插件生态都非常丰富，可满足用户的多种使用场景和需求； + +此外，由于 APISIX Ingress Controller 还具备如下独有的优势： + +- **兼容性好**：支持多个 Ingress 资源版本，在不同的 Kubernetes 版本中均可正常工作； +- **动态更新**：无论是 Ingress 资源或是证书等配置的更新，均已实现热加载，无需 reload，保障业务平稳运行； +- **扩容灵活**：由于 APISIX Ingress Controller 采用控制面和数据面分离的架构，所以在扩容时，可以单独扩容 Apache APISIX 这个数据面集群，而无须对 Apache APISIX Ingress Controller 进行扩容； +- **运维友好**：在当前架构下，用户可按实际情况选择将数据面 Apache APISIX 集群部署在 Kubernetes 集群中，或是部署在物理机环境。且 Apache APISIX Ingress Controller 故障不会对业务流量造成任何影响。 diff --git a/website/static/img/blog_img/2021-06-18-1.png b/website/static/img/blog_img/2021-06-18-1.png new file mode 100644 index 000..d726eae Binary files /dev/null and b/website/static/img/blog_img/2021-06-18-1.png differ
[GitHub] [apisix-website] netlify[bot] edited a comment on pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
netlify[bot] edited a comment on pull request #371: URL: https://github.com/apache/apisix-website/pull/371#issuecomment-863874026 :heavy_check_mark: Deploy Preview for *apisix* ready! :hammer: Explore the source changes: 096364e561fbf69d15d6a72f3670a424161ce021 :mag: Inspect the deploy log: [https://app.netlify.com/sites/apisix/deploys/60cd57ea1da5310007a94128](https://app.netlify.com/sites/apisix/deploys/60cd57ea1da5310007a94128?utm_source=github_campaign=bot_dl) :sunglasses: Browse the preview: [https://deploy-preview-371--apisix.netlify.app](https://deploy-preview-371--apisix.netlify.app?utm_source=github_campaign=bot_dp) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] netlify[bot] edited a comment on pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
netlify[bot] edited a comment on pull request #371: URL: https://github.com/apache/apisix-website/pull/371#issuecomment-863874026 :construction_worker: Deploy Preview for *apisix* processing. :hammer: Explore the source changes: 096364e561fbf69d15d6a72f3670a424161ce021 :mag: Inspect the deploy log: [https://app.netlify.com/sites/apisix/deploys/60cd57ea1da5310007a94128](https://app.netlify.com/sites/apisix/deploys/60cd57ea1da5310007a94128?utm_source=github_campaign=bot_dl) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] juzhiyuan commented on a change in pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
juzhiyuan commented on a change in pull request #371: URL: https://github.com/apache/apisix-website/pull/371#discussion_r654734869 ## File path: website/blog/2021-06-18-first-GA-version-v1.0-of-Apache-APISIX-Ingress-Controller-released.md ## @@ -0,0 +1,121 @@ +--- +title: "Apache APISIX Ingress Controller 首个 GA 版本 v1.0 正式发布！" +author: Jintao Zhang +authorURL: "https://github.com/tao12345666333; +authorImageURL: "https://avatars.githubusercontent.com/u/3264292?v=4; +--- +> [@tao12345666333](https://github.com/tao12345666333), Apache APISIX commiter from [Shenzhen Zhiliu Technology Co.](https://www.apiseven.com/) +> + + +### 关于 Apache APISIX Ingress Controller + +Apache APISIX Ingress Controller 是一个使用 Apache APISIX 作为数据面承载流量的云原生 Ingress Controller 实现，采用 CRD 的方式对 Kubernetes 进行了扩展。 + +可支持使用包括 ApisixRoute、ApisixUpstream 等自定义资源，以及 Kubernetes 原生 Ingress 资源等控制外部流量访问部署在 Kubernetes 中的服务。 + +整体架构如下： + + + +### v1.0 最新特性 + + 增加 ApisixConsumer 自定义资源使配置认证更方便 + +在之前的版本中，如果想要配置 keyAuth 或者 basicAuth 需要手动去调用 Apache APISIX 的 admin api 创建 consumer 配置。 + +在 v1.0 版本中，我们增加了 `ApisixConsumer` 资源，用户可以使用更原生的方式来定义 consumer 资源及为 ApisixRoute 配置认证。 + +例如通过以下配置定义一个 keyAuth 资源： + +```text +apiVersion: apisix.apache.org/v2alpha1 + +kind: ApisixConsumer + +metadata: + + name: keyauth + +spec: + + authParameter: + +keyAuth: + + value: + +key: API +``` + +在 ApisixRoute 中只需要增加对应类型的 `authentication` 配置即可。 + +```text +apiVersion: apisix.apache.org/v2alpha1 + +kind: ApisixRoute + +metadata: + + name: httpbin-route + +spec: + + http: + + ... + + authentication: + + enable: true + + type: keyAuth +``` + + 为 ApisixTls 增加 mTLS 支持 + +在 v1.0 版本中我们也为 ApisixTls 自定义资源增加了 mTLS 的支持，只需要在 ApisixTls 资源的配置中增加 client 配置即可，例如： + +```text Review comment: let me help @Serendipity96 to update this PR -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] tokers commented on a change in pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
tokers commented on a change in pull request #371: URL: https://github.com/apache/apisix-website/pull/371#discussion_r654734732 ## File path: website/blog/2021-06-18-first-GA-version-v1.0-of-Apache-APISIX-Ingress-Controller-released.md ## @@ -0,0 +1,121 @@ +--- +title: "Apache APISIX Ingress Controller 首个 GA 版本 v1.0 正式发布！" +author: Jintao Zhang +authorURL: "https://github.com/tao12345666333; +authorImageURL: "https://avatars.githubusercontent.com/u/3264292?v=4; +--- +> [@tao12345666333](https://github.com/tao12345666333), Apache APISIX commiter from [Shenzhen Zhiliu Technology Co.](https://www.apiseven.com/) +> + + +### 关于 Apache APISIX Ingress Controller + +Apache APISIX Ingress Controller 是一个使用 Apache APISIX 作为数据面承载流量的云原生 Ingress Controller 实现，采用 CRD 的方式对 Kubernetes 进行了扩展。 + +可支持使用包括 ApisixRoute、ApisixUpstream 等自定义资源，以及 Kubernetes 原生 Ingress 资源等控制外部流量访问部署在 Kubernetes 中的服务。 + +整体架构如下： + + + +### v1.0 最新特性 + + 增加 ApisixConsumer 自定义资源使配置认证更方便 + +在之前的版本中，如果想要配置 keyAuth 或者 basicAuth 需要手动去调用 Apache APISIX 的 admin api 创建 consumer 配置。 + +在 v1.0 版本中，我们增加了 `ApisixConsumer` 资源，用户可以使用更原生的方式来定义 consumer 资源及为 ApisixRoute 配置认证。 + +例如通过以下配置定义一个 keyAuth 资源： + +```text +apiVersion: apisix.apache.org/v2alpha1 + +kind: ApisixConsumer + +metadata: + + name: keyauth + +spec: + + authParameter: + +keyAuth: + + value: + +key: API +``` + +在 ApisixRoute 中只需要增加对应类型的 `authentication` 配置即可。 + +```text +apiVersion: apisix.apache.org/v2alpha1 + +kind: ApisixRoute + +metadata: + + name: httpbin-route + +spec: + + http: + + ... + + authentication: + + enable: true + + type: keyAuth +``` + + 为 ApisixTls 增加 mTLS 支持 + +在 v1.0 版本中我们也为 ApisixTls 自定义资源增加了 mTLS 的支持，只需要在 ApisixTls 资源的配置中增加 client 配置即可，例如： + +```text Review comment: Too many empty lines, should remove them so that the format can be compact. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-docker] tokers merged pull request #187: chore: update dashboard version in example
tokers merged pull request #187: URL: https://github.com/apache/apisix-docker/pull/187 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[apisix-docker] branch master updated: chore: update dashboard version in examples (#187)
This is an automated email from the ASF dual-hosted git repository. tokers pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/apisix-docker.git The following commit(s) were added to refs/heads/master by this push: new b0cbf74 chore: update dashboard version in examples (#187) b0cbf74 is described below commit b0cbf744dc023135ef2f8040362fc32063270640 Author: Shuyang Wu AuthorDate: Fri Jun 18 22:12:49 2021 -0400 chore: update dashboard version in examples (#187) Signed-off-by: yiyiyimu --- README.md | 6 +++--- example/docker-compose.yml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 9e23c6c..edb1207 100644 --- a/README.md +++ b/README.md @@ -8,9 +8,9 @@ 1. Build from release version: ```sh -# Assign Apache release version number to variable `APISIX_VERSION`, for example: 2.4. The latest version can be find at `https://github.com/apache/apisix/releases` +# Assign Apache release version number to variable `APISIX_VERSION`, for example: 2.6. The latest version can be find at `https://github.com/apache/apisix/releases` -export APISIX_VERSION=2.4 +export APISIX_VERSION=2.6 # alpine $ make build-on-alpine @@ -69,7 +69,7 @@ $ docker run -v `pwd`/all-in-one/apisix/config.yaml:/usr/local/apisix/conf/confi * All in one Docker container for Apache apisix-dashboard -**The latest version of `apisix-dashboard` is 2.4 and should be used with APISIX 2.3.** +**The latest version of `apisix-dashboard` is 2.7 and should be used with APISIX 2.6.** ```shell $ make build-dashboard diff --git a/example/docker-compose.yml b/example/docker-compose.yml index 5eae2aa..51e5595 100644 --- a/example/docker-compose.yml +++ b/example/docker-compose.yml @@ -2,7 +2,7 @@ version: "3" services: apisix-dashboard: -image: apache/apisix-dashboard:2.6 +image: apache/apisix-dashboard:2.7 restart: always volumes: - ./dashboard_conf/conf.yaml:/usr/local/apisix-dashboard/conf/conf.yaml @@ -12,7 +12,7 @@ services: apisix: apisix: -image: apache/apisix:2.5-alpine +image: apache/apisix:2.6-alpine restart: always volumes: - ./apisix_log:/usr/local/apisix/logs
[GitHub] [apisix] tokers merged pull request #4445: feat(stream): support client certificate verification
tokers merged pull request #4445: URL: https://github.com/apache/apisix/pull/4445 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[apisix] branch master updated: feat(stream): support client certificate verification (#4445)
This is an automated email from the ASF dual-hosted git repository.
tokers pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 4667633 feat(stream): support client certificate verification (#4445)
4667633 is described below
commit 46676333600ef91581351a1176015eff6f7a0421
Author: 罗泽轩
AuthorDate: Sat Jun 19 10:05:00 2021 +0800
feat(stream): support client certificate verification (#4445)
Signed-off-by: spacewander
---
apisix/init.lua | 24 +++--
t/stream-node/mtls.t | 242 +++
2 files changed, 261 insertions(+), 5 deletions(-)
diff --git a/apisix/init.lua b/apisix/init.lua
index 2560b30..c984656 100644
--- a/apisix/init.lua
+++ b/apisix/init.lua
@@ -303,10 +303,8 @@ local function get_upstream_by_id(up_id)
end
-function _M.http_access_phase()
-local ngx_ctx = ngx.ctx
-
-if ngx_ctx.api_ctx and ngx_ctx.api_ctx.ssl_client_verified then
+local function verify_tls_client(ctx)
+if ctx and ctx.ssl_client_verified then
local res = ngx_var.ssl_client_verify
if res ~= "SUCCESS" then
if res == "NONE" then
@@ -314,10 +312,22 @@ function _M.http_access_phase()
else
core.log.error("clent certificate verification is not passed:
", res)
end
-return core.response.exit(400)
+
+return false
end
end
+return true
+end
+
+
+function _M.http_access_phase()
+local ngx_ctx = ngx.ctx
+
+if not verify_tls_client(ngx_ctx.api_ctx) then
+return core.response.exit(400)
+end
+
-- always fetch table from the table pool, we don't need a reused api_ctx
local api_ctx = core.tablepool.fetch("api_ctx", 0, 32)
ngx_ctx.api_ctx = api_ctx
@@ -825,6 +835,10 @@ function _M.stream_preread_phase()
local ngx_ctx = ngx.ctx
local api_ctx = ngx_ctx.api_ctx
+if not verify_tls_client(ngx_ctx.api_ctx) then
+return ngx_exit(1)
+end
+
if not api_ctx then
api_ctx = core.tablepool.fetch("api_ctx", 0, 32)
ngx_ctx.api_ctx = api_ctx
diff --git a/t/stream-node/mtls.t b/t/stream-node/mtls.t
new file mode 100644
index 000..3caad2c
--- /dev/null
+++ b/t/stream-node/mtls.t
@@ -0,0 +1,242 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX;
+
+my $nginx_binary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+my $version = eval { `$nginx_binary -V 2>&1` };
+
+if ($version !~ m/\/apisix-nginx-module/) {
+plan(skip_all => "apisix-nginx-module not installed");
+} else {
+plan('no_plan');
+}
+
+repeat_each(1);
+
+add_block_preprocessor(sub {
+my ($block) = @_;
+
+if ((!defined $block->error_log) && (!defined $block->no_error_log)) {
+$block->set_value("no_error_log", "[error]");
+}
+});
+
+run_tests();
+
+__DATA__
+
+=== TEST 1: set client certificate
+--- config
+location /t {
+content_by_lua_block {
+local t = require("lib.test_admin")
+local json = require("toolkit.json")
+local ssl_ca_cert = t.read_file("t/certs/mtls_ca.crt")
+local ssl_cert = t.read_file("t/certs/mtls_client.crt")
+local ssl_key = t.read_file("t/certs/mtls_client.key")
+local data = {
+upstream = {
+scheme = "https",
+type = "roundrobin",
+nodes = {
+["127.0.0.1:2005"] = 1,
+},
+tls = {
+client_cert = ssl_cert,
+client_key = ssl_key,
+}
+},
+plugins = {
+["proxy-rewrite"] = {
+uri = "/hello"
+}
+},
+uri = "/mtls"
+}
+local code, body = t.test('/apisix/admin/routes/1',
+ngx.HTTP_PUT,
+json.encode(data)
+)
+
+if code >= 300 then
+ngx.status = code
+ngx.say(body)
+return
+
[GitHub] [apisix] tokers commented on issue #4447: request help: http_logger插件使用
tokers commented on issue #4447: URL: https://github.com/apache/apisix/issues/4447#issuecomment-864340547 All log messages are encoded into the request body. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4403: request help: apisix是否有类似于nginx proxy_next_upstream的请求重试机制
spacewander closed issue #4403: URL: https://github.com/apache/apisix/issues/4403 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] juzhiyuan commented on a change in pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
juzhiyuan commented on a change in pull request #371: URL: https://github.com/apache/apisix-website/pull/371#discussion_r654365997 ## File path: website/blog/2021-06-18-first-GA-version-v1.0-of-Apache-APISIX-Ingress-Controller-released.md ## @@ -0,0 +1,121 @@ +--- +title: "Apache APISIX Ingress Controller 首个 GA 版本 v1.0 正式发布！" +author: Jintao Zhang +authorURL: "https://github.com/tao12345666333; +authorImageURL: "https://avatars.githubusercontent.com/u/3264292?v=4; +--- +> [@tao12345666333](https://github.com/tao12345666333), Apache APISIX commiter from [Shenzhen Zhiliu Technology Co.](https://www.apiseven.com/) +> + + +### 关于 Apache APISIX Ingress Controller + +Apache APISIX Ingress Controller 是一个使用 Apache APISIX 作为数据面承载流量的云原生 Ingress Controller 实现，采用 CRD 的方式对 Kubernetes 进行了扩展。 + +可支持使用包括 ApisixRoute、ApisixUpstream 等自定义资源，以及 Kubernetes 原生 Ingress 资源等控制外部流量访问部署在 Kubernetes 中的服务。 + +整体架构如下： + + + +### v1.0 最新特性 + + 增加 ApisixConsumer 自定义资源使配置认证更方便 + +在之前的版本中，如果想要配置 keyAuth 或者 basicAuth 需要手动去调用 Apache APISIX 的 admin api 创建 consumer 配置。 + +在 v1.0 版本中，我们增加了 `ApisixConsumer` 资源，用户可以使用更原生的方式来定义 consumer 资源及为 ApisixRoute 配置认证。 + +例如通过以下配置定义一个 keyAuth 资源： + +```text +apiVersion: apisix.apache.org/v2alpha1 + +kind: ApisixConsumer + +metadata: + + name: keyauth + +spec: + + authParameter: + +keyAuth: + + value: + +key: API +``` + +在 ApisixRoute 中只需要增加对应类型的 `authentication` 配置即可。 + +```text Review comment: ```suggestion ```yaml ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] Serendipity96 opened a new pull request #370: docs: added Apache APISIX Dashboard Access Control Bypass Vulnerabili…
Serendipity96 opened a new pull request #370: URL: https://github.com/apache/apisix-website/pull/370 Changes: docs: added Apache APISIX Dashboard Access Control Bypass Vulnerability Announcement blog tips: The link at the end of the blog will be modified after another blog is merged -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] Serendipity96 closed pull request #370: docs: added Apache APISIX Dashboard Access Control Bypass Vulnerabili…
Serendipity96 closed pull request #370: URL: https://github.com/apache/apisix-website/pull/370 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] Serendipity96 opened a new pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
Serendipity96 opened a new pull request #371: URL: https://github.com/apache/apisix-website/pull/371 Changes: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] netlify[bot] commented on pull request #369: docs: added Chaos Mesh helps Apache APISIX improve stability blog
netlify[bot] commented on pull request #369: URL: https://github.com/apache/apisix-website/pull/369#issuecomment-863753716 :construction_worker: Deploy Preview for *apisix* processing. :hammer: Explore the source changes: 518171ddf64639aefadcf6a3a4d7847be187affa :mag: Inspect the deploy log: [https://app.netlify.com/sites/apisix/deploys/60cc2698ad4f7b0008f5af65](https://app.netlify.com/sites/apisix/deploys/60cc2698ad4f7b0008f5af65?utm_source=github_campaign=bot_dl) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3073: bug: config_etcd.lua:100: readdir(): grpc: received message larger than max (4236894 vs. 4194304)
spacewander commented on issue #3073: URL: https://github.com/apache/apisix/issues/3073#issuecomment-863718029 Fixed by https://github.com/etcd-io/etcd/pull/13077 which is included in the https://github.com/etcd-io/etcd/releases/tag/v3.5.0 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] 929404097 opened a new issue #4446: request help: 如何用http_logger插件？
929404097 opened a new issue #4446: URL: https://github.com/apache/apisix/issues/4446 ### Issue description 我使用了http_logger插件发送日志，日志是收到了，但没有携带任何信息，且error.log有报错 2021/06/18 16:45:30 [error] 1358#1358: *271527 [lua] batch-processor.lua:63: Batch Processor[http logger] failed to process entries: error while sending data to [192.168.3.45] port[7010] timeout, context: ngx.timer, client: 192.168.3.45, server: 0.0.0.0:9080 2021/06/18 16:45:30 [error] 1358#1358: *271527 [lua] batch-processor.lua:70: Batch Processor[http logger] exceeded the max_retry_count[1] dropping the entries, context: ngx.timer, client: 192.168.3.45, server: 0.0.0.0:9080 ### Environment Request help without environment information will be ignored or closed. * apisix version (cmd: `apisix version`):2.6 * OS (cmd: `uname -a`):centos7 * OpenResty / Nginx version (cmd: `nginx -V` or `openresty -V`): * etcd version, if have (cmd: run `curl http://127.0.0.1:9090/v1/server_info` to get the info from server-info API):3.4 * apisix-dashboard version, if have:2.7 * luarocks version, if the issue is about installation (cmd: `luarocks --version`): -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] netlify[bot] edited a comment on pull request #370: docs: added Apache APISIX Dashboard Access Control Bypass Vulnerabili…
netlify[bot] edited a comment on pull request #370: URL: https://github.com/apache/apisix-website/pull/370#issuecomment-863844679 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] freeocs opened a new issue #4444: bug: docker自动重启后就无法正常加载
freeocs opened a new issue #: URL: https://github.com/apache/apisix/issues/ ### Issue description ### Environment Bug report without environment information will be ignored or closed. * apisix version (cmd: `apisix version`): 2.5 * OS (cmd: `uname -a`):Linux 4.15.0-144-generic #148-Ubuntu SMP Sat May 8 02:33:43 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux * OpenResty / Nginx version (cmd: `nginx -V` or `openresty -V`):nginx/1.18.0 ### What's the actual result? (including assertion message & call stack if applicable) ``` /usr/local/openresty/luajit/bin/luajit ./apisix/cli/apisix.lua init /usr/local/openresty/luajit/bin/luajit ./apisix/cli/apisix.lua init_etcd nginx: [emerg] unexpected end of parameter, expecting ";" in command line ### What's the expected result? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander merged pull request #4443: fix: move lua_ssl_trusted_certificate to work with background timer
spacewander merged pull request #4443: URL: https://github.com/apache/apisix/pull/4443 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] netlify[bot] edited a comment on pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
netlify[bot] edited a comment on pull request #371: URL: https://github.com/apache/apisix-website/pull/371#issuecomment-863874026 :heavy_check_mark: Deploy Preview for *apisix* ready! :hammer: Explore the source changes: 95dd61c71463dbaa3b914ff111053118a792468d :mag: Inspect the deploy log: [https://app.netlify.com/sites/apisix/deploys/60cc5e2754d0e10008035a66](https://app.netlify.com/sites/apisix/deploys/60cc5e2754d0e10008035a66?utm_source=github_campaign=bot_dl) :sunglasses: Browse the preview: [https://deploy-preview-371--apisix.netlify.app](https://deploy-preview-371--apisix.netlify.app?utm_source=github_campaign=bot_dp) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] coolincy commented on issue #4323: request help: About Consul integration design question
coolincy commented on issue #4323: URL: https://github.com/apache/apisix/issues/4323#issuecomment-863910851 kv can not check upstream's health, service can check , so why user kv? If kv, I think redis is better. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] zuiyangqingzhou commented on issue #4442: Does apisix support etcd service discovery
zuiyangqingzhou commented on issue #4442: URL: https://github.com/apache/apisix/issues/4442#issuecomment-863706832 But I saw the following paragraph in the readme file, which clearly stated that in addition to the built-in etcd, it also supports Nacos, etc.  If you don’t support it, does this sentence cause misunderstanding? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #3616: request help: how nodes will be recovered from unhealthy
spacewander closed issue #3616: URL: https://github.com/apache/apisix/issues/3616 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #4442: Does apisix support etcd service discovery
spacewander commented on issue #4442: URL: https://github.com/apache/apisix/issues/4442#issuecomment-86374 APISIX indeed supports using etcd for service discovery. There is no official service discovery API in etcd. So the only one to use etcd is writing your own discovery framework. It is also the way we do in APISIX. When we put this configuration into etcd via Admin API or via something else: ``` /apisix/upstreams/myAPIProvider ... /apisix/routes/1 ..."upstream_id":"myAPIProvider" ``` We are already doing service discovery. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] tzssangglass commented on issue #4442: Does apisix support etcd service discovery
tzssangglass commented on issue #4442: URL: https://github.com/apache/apisix/issues/4442#issuecomment-863491601 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander opened a new pull request #4443: fix: move lua_ssl_trusted_certificate to work with background timer
spacewander opened a new pull request #4443: URL: https://github.com/apache/apisix/pull/4443 Fix #4370 Signed-off-by: spacewander ### What this PR does / why we need it: ### Pre-submission checklist: * [x] Did you explain what problem does this PR solve? Or what new features have been added? * [ ] Have you added corresponding test cases? * [ ] Have you modified the corresponding document? * [ ] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix/tree/master#community) first** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-dashboard] juzhiyuan commented on issue #1944: When Dashboard and APISIX version do not match, make the prompt information clearer
juzhiyuan commented on issue #1944: URL: https://github.com/apache/apisix-dashboard/issues/1944#issuecomment-863818911 API should return the matched version list and web should show Translation :) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] Yiyiyimu commented on a change in pull request #4427: docs: use mockbin to view http logs for guidance
Yiyiyimu commented on a change in pull request #4427: URL: https://github.com/apache/apisix/pull/4427#discussion_r653880542 ## File path: docs/en/latest/plugins/http-logger.md ## @@ -54,14 +54,14 @@ This will provide the ability to send Log data requests as JSON objects to Monit ## How To Enable -The following is an example on how to enable the http-logger for a specific route. +The following is an example of how to enable the http-logger for a specific route. You could generate a mock HTTP server at [mockbin](http://mockbin.org/bin/create) to view the logs. Review comment: ```suggestion The following is an example of how to enable the `http-logger` for a specific route. You could generate a mock HTTP server at [mockbin](http://mockbin.org/bin/create) to view the logs. ``` ## File path: docs/zh/latest/plugins/http-logger.md ## @@ -54,14 +54,14 @@ title: http-logger ## 如何开启 -这是有关如何为特定路由启用 http-logger 插件的示例。 +这是有关如何为特定路由启用 http-logger 插件的示例。你可以在 [mockbin](http://mockbin.org/bin/create) 生成一个模拟 HTTP 服务器来浏览生成的日志 Review comment: ```suggestion 这是有关如何为特定路由启用 `http-logger` 插件的示例。你可以在 [mockbin](http://mockbin.org/bin/create) 生成一个模拟 HTTP 服务器来浏览生成的日志 ``` ## File path: docs/en/latest/plugins/http-logger.md ## @@ -54,14 +54,14 @@ This will provide the ability to send Log data requests as JSON objects to Monit ## How To Enable -The following is an example on how to enable the http-logger for a specific route. +The following is an example on how to enable the http-logger for a specific route. You could generate an mock HTTP server at [mockbin](http://mockbin.org/bin/create) to view the logs. Review comment: Thanks! fixed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #4240: request help: APIs too many cause 503 + proxy delay too much
spacewander commented on issue #4240: URL: https://github.com/apache/apisix/issues/4240#issuecomment-863717772 Fixed by https://github.com/etcd-io/etcd/pull/13077 which is included in the https://github.com/etcd-io/etcd/releases/tag/v3.5.0 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-go-plugin-runner] spacewander merged pull request #9: fix: handle err before out
spacewander merged pull request #9: URL: https://github.com/apache/apisix-go-plugin-runner/pull/9 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4370: request help: An error is reported when the configuration is updated from etcd regularly
spacewander closed issue #4370: URL: https://github.com/apache/apisix/issues/4370 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4442: Does apisix support etcd service discovery
spacewander closed issue #4442: URL: https://github.com/apache/apisix/issues/4442 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #3631: docs: the health check document adds more detailed usage details.
spacewander closed issue #3631: URL: https://github.com/apache/apisix/issues/3631 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander opened a new pull request #4445: feat(stream): support client certificate verification
spacewander opened a new pull request #4445: URL: https://github.com/apache/apisix/pull/4445 Signed-off-by: spacewander ### What this PR does / why we need it: ### Pre-submission checklist: * [x] Did you explain what problem does this PR solve? Or what new features have been added? * [x] Have you added corresponding test cases? * [ ] Have you modified the corresponding document? * [ ] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix/tree/master#community) first** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] 929404097 opened a new issue #4447: request help:
929404097 opened a new issue #4447: URL: https://github.com/apache/apisix/issues/4447 ### Issue description http_logger插件，服务端要用什么参数名接收传过来的信息？请求是收到了，但是没看到request里携带有任何的信息   ### Environment Request help without environment information will be ignored or closed. * apisix version (cmd: `apisix version`):2.6 * OS (cmd: `uname -a`):win10 * OpenResty / Nginx version (cmd: `nginx -V` or `openresty -V`): * etcd version, if have (cmd: run `curl http://127.0.0.1:9090/v1/server_info` to get the info from server-info API): * apisix-dashboard version, if have:2.7 * luarocks version, if the issue is about installation (cmd: `luarocks --version`): -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4240: request help: APIs too many cause 503 + proxy delay too much
spacewander closed issue #4240: URL: https://github.com/apache/apisix/issues/4240 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] netlify[bot] commented on pull request #370: docs: added Apache APISIX Dashboard Access Control Bypass Vulnerabili…
netlify[bot] commented on pull request #370: URL: https://github.com/apache/apisix-website/pull/370#issuecomment-863844679 :construction_worker: Deploy Preview for *apisix* processing. :hammer: Explore the source changes: ad2f40116d8cc0fafa7dc196a3dc48d220e1036d :mag: Inspect the deploy log: [https://app.netlify.com/sites/apisix/deploys/60cc539eee99be0007d33c2b](https://app.netlify.com/sites/apisix/deploys/60cc539eee99be0007d33c2b?utm_source=github_campaign=bot_dl) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] Marco-Zheng commented on issue #4439: bug: confusing result for traffic split plugin 灰度插件的结果混乱
Marco-Zheng commented on issue #4439: URL: https://github.com/apache/apisix/issues/4439#issuecomment-863722546 @tzssangglass I upgrade the apisix to version 2.6, the problem has been solved, thanks a lot! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander merged pull request #4435: docs: show the graceful way to stop
spacewander merged pull request #4435: URL: https://github.com/apache/apisix/pull/4435 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] membphis merged pull request #4438: chore(deps): bump actions/upload-artifact from 2.2.3 to 2.2.4
membphis merged pull request #4438: URL: https://github.com/apache/apisix/pull/4438 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] coolincy commented on issue #4448: Consul integration: why not use service but use kv?
coolincy commented on issue #4448: URL: https://github.com/apache/apisix/issues/4448#issuecomment-863910947 consul 的 kv 不能自动探活 upstream, 那实际上还不如用 redis -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4411: request help: upstream timed out (110: Connection timed out) while reading response header from upstream
spacewander closed issue #4411: URL: https://github.com/apache/apisix/issues/4411 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4425: request help: router count
spacewander closed issue #4425: URL: https://github.com/apache/apisix/issues/4425 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] tzssangglass commented on issue #4446: request help: 如何用http_logger插件？
tzssangglass commented on issue #4446: URL: https://github.com/apache/apisix/issues/4446#issuecomment-863886335 according to the `error.log`, it was sent to the log collection service that timed out. please check the network and the timeout settings on the log collection service first. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] netlify[bot] edited a comment on pull request #369: docs: added Chaos Mesh helps Apache APISIX improve stability blog
netlify[bot] edited a comment on pull request #369: URL: https://github.com/apache/apisix-website/pull/369#issuecomment-863753716 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander merged pull request #4436: docs: clarify why we require active health check
spacewander merged pull request #4436: URL: https://github.com/apache/apisix/pull/4436 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] Yiyiyimu closed issue #4439: bug: confusing result for traffic split plugin 灰度插件的结果混乱
Yiyiyimu closed issue #4439: URL: https://github.com/apache/apisix/issues/4439 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] juzhiyuan merged pull request #369: docs: added Chaos Mesh helps Apache APISIX improve stability blog
juzhiyuan merged pull request #369: URL: https://github.com/apache/apisix-website/pull/369 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4448: Consul integration: why not use service but use kv?
spacewander closed issue #4448: URL: https://github.com/apache/apisix/issues/4448 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #4448: Consul integration: why not use service but use kv?
spacewander commented on issue #4448: URL: https://github.com/apache/apisix/issues/4448#issuecomment-863918894 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-go-plugin-runner] spacewander merged pull request #8: feat: add an entrance for profile
spacewander merged pull request #8: URL: https://github.com/apache/apisix-go-plugin-runner/pull/8 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-dashboard] nic-chen opened a new issue #1944: When Dashboard and APISIX version do not match, make the prompt information clearer
nic-chen opened a new issue #1944: URL: https://github.com/apache/apisix-dashboard/issues/1944 # Feature request ## Please describe your feature When the APISIX version does not match the Dashboard version, the prompt information is not clear enough to allow users to directly know why the prompt is prompted. The matching version should be given directly  ## Describe the solution you'd like Add the current version number and the required version in the prompt message -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] coolincy opened a new issue #4448: Consul integration: why not use service but use kv?
coolincy opened a new issue #4448: URL: https://github.com/apache/apisix/issues/4448 为什么不使用 v1/agent/service/ 而用 v1/kv/ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] 929404097 commented on issue #4446: request help: 如何用http_logger插件？
929404097 commented on issue #4446: URL: https://github.com/apache/apisix/issues/4446#issuecomment-863889527 > according to the `error.log`, it was sent to the log collection service that timed out. please check the network and the timeout settings on the log collection service first. 我日志收集服务器是可以收到请求的，只不过没有任何其他参数带过来，只是一个空请求 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] membphis merged pull request #4427: docs: use mockbin to view http logs for guidance
membphis merged pull request #4427: URL: https://github.com/apache/apisix/pull/4427 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] netlify[bot] commented on pull request #371: docs: added first GA version v1.0 of Apache APISIX Ingress Controller released blog
netlify[bot] commented on pull request #371: URL: https://github.com/apache/apisix-website/pull/371#issuecomment-863874026 :construction_worker: Deploy Preview for *apisix* processing. :hammer: Explore the source changes: 95dd61c71463dbaa3b914ff111053118a792468d :mag: Inspect the deploy log: [https://app.netlify.com/sites/apisix/deploys/60cc5e2754d0e10008035a66](https://app.netlify.com/sites/apisix/deploys/60cc5e2754d0e10008035a66?utm_source=github_campaign=bot_dl) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] tokers commented on issue #4444: bug: docker自动重启后就无法正常加载
tokers commented on issue #: URL: https://github.com/apache/apisix/issues/#issuecomment-863802356 Please give a minimal case to reproduce it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-docker] Yiyiyimu opened a new pull request #187: chore: update dashboard version in example
Yiyiyimu opened a new pull request #187: URL: https://github.com/apache/apisix-docker/pull/187 Signed-off-by: yiyiyimu -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #3073: bug: config_etcd.lua:100: readdir(): grpc: received message larger than max (4236894 vs. 4194304)
spacewander closed issue #3073: URL: https://github.com/apache/apisix/issues/3073 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] 929404097 closed issue #4446: request help: 如何用http_logger插件？
929404097 closed issue #4446: URL: https://github.com/apache/apisix/issues/4446 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix-website] Serendipity96 opened a new pull request #369: docs: added Chaos Mesh helps Apache APISIX improve stability blog
Serendipity96 opened a new pull request #369: URL: https://github.com/apache/apisix-website/pull/369 Changes: docs: added Chaos Mesh helps Apache APISIX improve stability blog -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [apisix] spacewander closed issue #4410: request help: how to config browser cache in apisix:2.6
spacewander closed issue #4410: URL: https://github.com/apache/apisix/issues/4410 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[apisix] branch master updated: docs: use mockbin to view http logs for guidance (#4427)
This is an automated email from the ASF dual-hosted git repository.
membphis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new bf90cbe docs: use mockbin to view http logs for guidance (#4427)
bf90cbe is described below
commit bf90cbe81e601591953b9a04166bdc86b50118d8
Author: Shuyang Wu
AuthorDate: Fri Jun 18 06:23:37 2021 -0400
docs: use mockbin to view http logs for guidance (#4427)
Co-authored-by: 罗泽轩
---
docs/en/latest/plugins/http-logger.md | 4 ++--
docs/zh/latest/plugins/http-logger.md | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/docs/en/latest/plugins/http-logger.md
b/docs/en/latest/plugins/http-logger.md
index 84bc743..104452c 100644
--- a/docs/en/latest/plugins/http-logger.md
+++ b/docs/en/latest/plugins/http-logger.md
@@ -54,14 +54,14 @@ This will provide the ability to send Log data requests as
JSON objects to Monit
## How To Enable
-The following is an example on how to enable the http-logger for a specific
route.
+The following is an example of how to enable the `http-logger` for a specific
route. You could generate a mock HTTP server at
[mockbin](http://mockbin.org/bin/create) to view the logs.
```shell
curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY:
edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"plugins": {
"http-logger": {
-"uri": "http://127.0.0.1:80/postendpoint?param=1;
+"uri": "http://mockbin.org/bin/:ID;
}
},
"upstream": {
diff --git a/docs/zh/latest/plugins/http-logger.md
b/docs/zh/latest/plugins/http-logger.md
index 3120177..811c9d0 100644
--- a/docs/zh/latest/plugins/http-logger.md
+++ b/docs/zh/latest/plugins/http-logger.md
@@ -54,14 +54,14 @@ title: http-logger
## 如何开启
-这是有关如何为特定路由启用 http-logger 插件的示例。
+这是有关如何为特定路由启用 `http-logger` 插件的示例。你可以在
[mockbin](http://mockbin.org/bin/create) 生成一个模拟 HTTP 服务器来浏览生成的日志
```shell
curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY:
edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"plugins": {
"http-logger": {
-"uri": "http://127.0.0.1:80/postendpoint?param=1;
+"uri": "http://mockbin.org/bin/:ID;
}
},
"upstream": {
[apisix] branch master updated: chore(deps): bump actions/upload-artifact from 2.2.3 to 2.2.4 (#4438)
This is an automated email from the ASF dual-hosted git repository.
membphis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new af385a5 chore(deps): bump actions/upload-artifact from 2.2.3 to 2.2.4
(#4438)
af385a5 is described below
commit af385a5659cafbeabf4925c3939a6fd9a566114b
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Fri Jun 18 18:22:35 2021 +0800
chore(deps): bump actions/upload-artifact from 2.2.3 to 2.2.4 (#4438)
---
.github/workflows/build.yml | 2 +-
.github/workflows/centos7-ci.yml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a6c3437..8fb0b27 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -162,7 +162,7 @@ jobs:
- name: Publish Artifact
if: ${{ startsWith(github.ref, 'refs/heads/release/') &&
matrix.os_name == 'linux_openresty' }}
-uses: actions/upload-artifact@v2.2.3
+uses: actions/upload-artifact@v2.2.4
with:
name: ${{ steps.branch_env.outputs.fullname }}
path: ${{ steps.branch_env.outputs.fullname }}
diff --git a/.github/workflows/centos7-ci.yml b/.github/workflows/centos7-ci.yml
index 4c5bb3e..dc533b0 100644
--- a/.github/workflows/centos7-ci.yml
+++ b/.github/workflows/centos7-ci.yml
@@ -111,7 +111,7 @@ jobs:
- name: Publish Artifact
if: ${{ startsWith(github.ref, 'refs/heads/release/') }}
- uses: actions/upload-artifact@v2.2.3
+ uses: actions/upload-artifact@v2.2.4
with:
name: "rpm"
path: "./apisix-build-tools/output/apisix-${{
steps.branch_env.outputs.version }}-0.x86_64.rpm"
[apisix] branch master updated: fix: move lua_ssl_trusted_certificate to work with background timer (#4443)
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new c22d3db fix: move lua_ssl_trusted_certificate to work with background
timer (#4443)
c22d3db is described below
commit c22d3db00a75a4cf665919128fb31889369467bc
Author: 罗泽轩
AuthorDate: Fri Jun 18 18:12:45 2021 +0800
fix: move lua_ssl_trusted_certificate to work with background timer (#4443)
---
apisix/cli/ngx_tpl.lua | 8
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/apisix/cli/ngx_tpl.lua b/apisix/cli/ngx_tpl.lua
index 42dfaeb..3e44b53 100644
--- a/apisix/cli/ngx_tpl.lua
+++ b/apisix/cli/ngx_tpl.lua
@@ -260,6 +260,10 @@ http {
{% end %}
{% end %}
+{% if ssl.ssl_trusted_certificate ~= nil then %}
+lua_ssl_trusted_certificate {* ssl.ssl_trusted_certificate *};
+{% end %}
+
# http configuration snippet starts
{% if http_configuration_snippet then %}
{* http_configuration_snippet *}
@@ -440,10 +444,6 @@ http {
server_name _;
-{% if ssl.ssl_trusted_certificate ~= nil then %}
-lua_ssl_trusted_certificate {* ssl.ssl_trusted_certificate *};
-{% end %}
-
{% if ssl.enable then %}
ssl_certificate {* ssl.ssl_cert *};
ssl_certificate_key {* ssl.ssl_cert_key *};
[apisix] branch master updated (1cf9075 -> 059ad7d)
This is an automated email from the ASF dual-hosted git repository. spacewander pushed a change to branch master in repository https://gitbox.apache.org/repos/asf/apisix.git. from 1cf9075 docs: clarify why we require active health check (#4436) add 059ad7d docs: show the graceful way to stop (#4435) No new revisions were added by this update. Summary of changes: Makefile | 8 +++- docs/en/latest/how-to-build.md | 20 docs/zh/latest/how-to-build.md | 20 3 files changed, 15 insertions(+), 33 deletions(-)
[apisix-website] branch master updated: docs: added Chaos Mesh helps Apache APISIX improve stability blog (#369)
This is an automated email from the ASF dual-hosted git repository. juzhiyuan pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/apisix-website.git The following commit(s) were added to refs/heads/master by this push: new cd31f02 docs: added Chaos Mesh helps Apache APISIX improve stability blog (#369) cd31f02 is described below commit cd31f026ee20f4680f7d662681b7c4d11a9a778f Author: Serendipity96 AuthorDate: Fri Jun 18 14:55:24 2021 +0800 docs: added Chaos Mesh helps Apache APISIX improve stability blog (#369) Co-authored-by: 琚致远 --- .markdownlint.yml | 4 ++ ...s-Mesh-helps-Apache-APISIX-improve-stability.md | 67 + website/static/img/blog_img/2021-06-16-1.png | Bin 0 -> 490716 bytes website/static/img/blog_img/2021-06-16-2.png | Bin 0 -> 836754 bytes 4 files changed, 71 insertions(+) diff --git a/.markdownlint.yml b/.markdownlint.yml index 64ebbc0..9811d56 100644 --- a/.markdownlint.yml +++ b/.markdownlint.yml @@ -4,6 +4,10 @@ MD013: false # MD014 Dollar signs used before commands without showing output MD014: false +# MD024 Multiple headings with the same content +MD024: + siblings_only: true + # MD026/no-trailing-punctuation Trailing punctuation in heading MD026: false diff --git a/website/blog/2021-06-16-Chaos-Mesh-helps-Apache-APISIX-improve-stability.md b/website/blog/2021-06-16-Chaos-Mesh-helps-Apache-APISIX-improve-stability.md new file mode 100644 index 000..bb4ea95 --- /dev/null +++ b/website/blog/2021-06-16-Chaos-Mesh-helps-Apache-APISIX-improve-stability.md @@ -0,0 +1,67 @@ +--- +title: "Chaos Mesh 助力 Apache APISIX 提升稳定性" +author: Yiyiyimu +authorURL: "https://github.com/Yiyiyimu; +authorImageURL: "https://avatars.githubusercontent.com/u/34589752?v=4; +--- +> [@Yiyiyimu](https://github.com/Yiyiyimu),Apache APISIX committer from [Shenzhen Zhiliu Technology Co.](https://www.apiseven.com/) +> + + +Apache APISIX 是 Apache 基金会下的顶级项目，目前在生产环境中已经通过每日几百亿次请求量的考验。随着社区的发展，Apache APISIX 的功能越来越多，需要与外部组件产生的交互也越来越多，随之而来的不确定性呈指数级增长。在社区中，我们也收到了用户反馈的一些问题，这里举两个例子。 + + 场景一 + +在 Apache APISIX 的配置中心， etcd 与 Apache APISIX 之间出现意外的高网络延迟时，Apache APISIX 能否仍然正常运行进行流量过滤转发？ + + 场景二 + +用户在 issue 反馈，当 etcd 集群中的一个节点失效而集群仍然可以正常运行时，会出现与 Apache APISIX admin API 交互报错的情况。 + +尽管 Apache APISIX 在 CI 中通过单元 / e2e / fuzz 测试覆盖了大部分情景，然而尚未覆盖到与外部组件的交互。当发生网络波动、硬盘故障、或是进程被杀掉等难以预料的异常行为时，Apache APISIX 能否给出合适的错误信息、是否可以保持或自行恢复到正常的运行状态呢？为了测试覆盖到用户提出的场景，以及在投入生产环境前主动发现类似的问题，经过社区讨论决定使用 PingCAP 开源的混沌工程平台 Chaos Mesh 进行测试。 + +混沌工程是一种在系统基础设施上进行试验，主动找出系统中的脆弱环节的方法，从而确保系统具有抵御生产环境中失控环境的能力。混沌工程最早由 Netflix 提出，用以模拟从而抵御早期云服务的不稳定性。随着技术的演进，现在的混沌工程平台提供了更多种类的故障可供注入，依靠 Kubernetes 也可以更方便地控制故障半径。这些都是 Apache APISIX 选择 Chaos Mesh 的重要原因，但作为开源社区，Apache APISIX 深知只有活跃的社区才能确保软件稳定使用和快速迭代，而这也是 Chaos Mesh 更加吸引人的特点。 + +### 如何在 APISIX 上应用混沌工程 + +混沌工程在单纯的注入故障以外，逐渐形成了一套完整的方法论。根据 Principle of Chaos Engineering 的推荐，部署混沌工程实验需要五个步骤： + +1. 定义稳态，即找到一个证明正常运行的可量化指标。 +2. 做出假设，假设指标在实验组和对照组都始终保持稳定状态。 +3. 设计实验，引入运行中可能出现的故障。 +4. 验证假设，即通过比较实验组和对照组的结果证伪假设。 +5. 修复问题。 + +接下来以上述两个用户反馈场景为例，依照这五个步骤为大家介绍 Apache APISIX 应用混沌工程的流程。 + + 场景一 + + + +用一幅图来描述这个场景。对照上面的五个步骤，首先需要找到衡量 Apache APISIX 正常运行的可量化指标。在测试时最主要的方法是利用 Grafana 对 Apache APISIX 运行指标进行监测，找到可衡量的指标后，在 CI 中就可以从 Prometheus 中单独提取数据进行比较判断，这里使用了路由转发的 Request per Second（RPS）和 etcd 的可连接性 作为评价指标。另一点就是需要对日志进行分析，对于 Apache APISIX 就是查看 Nginx 的 error.log 判断是否有报错以及报错是否符合预期。 + +在对照组也就是引入 Chaos 前进行实验，检测 set/get route 均能成功，etcd 可连接，并记录此时的 RPS。之后，使用 network chaos 添加 5s 的网络延迟 ，再次进行实验，此时 set route 失败，get route 成功，etcd 无法连接，RPS 与之前相比无明显变化。实验符合预期。 + + 场景二 + + + +进行同样的对照组实验之后引入 pod-kill chaos，复现了预期的错误。在随机删除集群中少数 etcd 节点的情况下，etcd 可连接性表现出时有时无，日志则打印出了大量连接拒绝的报错。更加有趣的是，在删除 etcd 端点列表的第一个或第三个节点时，设置路由正常返回，而只有在删除 etcd 端点列表中的第二个节点时，设置路由会报错 “connection refused”。 + +排查发现原因在于 Apache APISIX 使用的 etcd lua API 选择端点时并不是随机而是顺序选择，因此新建 etcd client 进行的操作就相当于只绑定在一个 etcd 端点上导致持续性的失败。修复这个问题之后，还为 etcd lua API 添加了健康检查，确保不会在断开连接的 etcd 上进行大量的重复；以及增加了 etcd 集群完全断开连接时的回退检查，避免大量报错冲爆日志。 + +### 未来计划 + + 1. 借助 e2e 模拟场景进行混沌测试 + +目前在 Apache APISIX 中，仍然主要依靠人来识别系统中可能的脆弱点进行测试修复。对于开源社区来说，与之前提到的 Netflix 在企业中应用混沌工程不同，尽管在 CI 中测试，无需担心混沌工程的故障半径对生产环境的影响，但同时也无法覆盖生产环境中的复杂而全面的场景。 + +为了覆盖更多的场景，未来社区计划利用现有的 e2e 测试模拟更加完整的场景，进行更大范围、更强随机性的混沌测试。 + + 2. 为更多 Apache APISIX 项目添加混沌测试 + +除了为 Apache APISIX 找到更多可能的脆弱点之外，社区还计划为 Apache APISIX Dashboard 和 Apache APISIX Ingress Controller 等更多项目添加混沌测试。 + + 3. 为 Chaos Mesh 添加功能 + +在部署 Chaos Mesh 时遇见一些暂不支持的功能，包括网络延迟的目标不支持选择 service，网络混沌无法指定容器端口注入等，Apache APISIX 社区未来也会协助 Chaos Mesh 添加相关功能。希望开源社区都会越来越好。 diff --git a/website/static/img/blog_img/2021-06-16-1.png b/website/static/img/blog_img/2021-06-16-1.png new file mode 100644 index 000..3f1fe93 Binary files /dev/null and b/website/static/img/blog_img/2021-06-16-1.png differ diff --git a/website/static/img/blog_img/2021-06-16-2.png
[apisix] branch master updated: docs: clarify why we require active health check (#4436)
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 1cf9075 docs: clarify why we require active health check (#4436)
1cf9075 is described below
commit 1cf90757506ccbfb97afb9e12f54a71e83152c68
Author: 罗泽轩
AuthorDate: Fri Jun 18 14:54:26 2021 +0800
docs: clarify why we require active health check (#4436)
---
docs/en/latest/health-check.md | 1 +
docs/zh/latest/health-check.md | 3 ++-
t/node/healthcheck-passive.t | 49 +-
3 files changed, 51 insertions(+), 2 deletions(-)
diff --git a/docs/en/latest/health-check.md b/docs/en/latest/health-check.md
index 7c13848..ab9bbff 100644
--- a/docs/en/latest/health-check.md
+++ b/docs/en/latest/health-check.md
@@ -33,6 +33,7 @@ There won't be any health check if an upstream is configured
but isn't in used.
* If there is no healthy node can be chosen, we will continue to access the
upstream.
* We won't start the health check when the upstream only has one node, as we
will access
it whether this unique node is healthy or not.
+* Active health check is required so that the unhealthy node can recover.
The following is an example of health check:
diff --git a/docs/zh/latest/health-check.md b/docs/zh/latest/health-check.md
index 9eb535c..a75f995 100644
--- a/docs/zh/latest/health-check.md
+++ b/docs/zh/latest/health-check.md
@@ -32,6 +32,7 @@ APISIX
的健康检查使用[lua-resty-healthcheck](https://github.com/Kong/lua-
* 如果没有健康的节点，那么请求会继续发送给上游。
* 如果 upstream 中只有一个节点，就不会有健康检查。
因为该唯一节点无论是否健康，请求都会发送给上游，
+* 主动健康检查是必须的，这样不健康的节点才会恢复。
下面是一个检查检查的例子：
@@ -87,7 +88,7 @@ curl http://127.0.0.1:9080/apisix/admin/routes/1 -H
'X-API-KEY: edd1c9f034335f13
监控检查的配置内容在`checks`中，`checks`包含两个类型：`active` 和 `passive`，详情如下
-* `active`: 要启动探活健康检查，需要在 upstream 配置中的 `checks.active` 添加如下配置项。
+* `active`: 要启动主动健康检查，需要在 upstream 配置中的 `checks.active` 添加如下配置项。
* `active.timeout`: 主动健康检查 socket 超时时间（秒为单位），支持小数点。比如 `1.01` 代表 `1010`
毫秒，`2` 代表 `2000` 毫秒。
diff --git a/t/node/healthcheck-passive.t b/t/node/healthcheck-passive.t
index c554224..dd34c17 100644
--- a/t/node/healthcheck-passive.t
+++ b/t/node/healthcheck-passive.t
@@ -27,7 +27,7 @@ run_tests();
__DATA__
-=== TEST 1: set route(only passive)
+=== TEST 1: set route(passive)
--- config
location /t {
content_by_lua_block {
@@ -118,3 +118,50 @@ GET /t
{"200":5,"502":1}
--- error_log
(upstream#/apisix/routes/1) unhealthy HTTP increment (1/1)
+
+
+
+=== TEST 3: set route(only passive)
+--- config
+location /t {
+content_by_lua_block {
+local t = require("lib.test_admin").test
+local code, body = t('/apisix/admin/routes/1',
+ngx.HTTP_PUT,
+[[{
+"uri": "/server_port",
+"upstream": {
+"type": "roundrobin",
+"nodes": {
+"127.0.0.1:1980": 0,
+"127.0.0.1:1": 1
+},
+"retries": 0,
+"checks": {
+"passive": {
+"healthy": {
+"http_statuses": [200, 201],
+"successes": 3
+},
+"unhealthy": {
+"http_statuses": [502],
+"http_failures": 1,
+"tcp_failures": 1
+}
+}
+}
+}
+}]]
+)
+
+if code >= 300 then
+ngx.status = code
+end
+ngx.print(body)
+}
+}
+--- request
+GET /t
+--- error_code: 400
+--- response_body
+{"error_msg":"invalid configuration: property \"upstream\" validation failed:
property \"checks\" validation failed: object matches none of the requireds:
[\"active\"] or [\"active\",\"passive\"]"}
