You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "Sebastian-Pietrzak (via GitHub)" <gi...@apache.org> on 2024/04/10 08:04:32 UTC
[I] bug: unable to setup ssls [apisix]
Sebastian-Pietrzak opened a new issue, #11141:
URL: https://github.com/apache/apisix/issues/11141
### Current Behavior
I'm struggling with adding certificate with /ssls admin endpoint using env reference.
```
curl --location --request PUT 'http://127.0.0.1:9180/apisix/admin/ssls' \
--header 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
--header 'Content-Type: application/json' \
--data '{
"id": "some_id",
"type": "server",
"snis": ["localhost"],
"cert": "$ENV://APISIX_ENV_CERT",
"key": "$ENV://APISIX_ENV_KEY",
"ssl_protocols": ["TLSv1.2", "TLSv1.3"]
}'
```
I'm always getting this, no matter what I put inside cert/key fields unless they are proper certs.
```
{
"error_msg": "invalid configuration: property \"key\" validation failed: value should match only one schema, but matches none"
}
```
Accordingly to [admin api documentation](https://apisix.apache.org/docs/apisix/admin-api/#request-body-parameters-4) those fields support those env references, but it seems it's not the case. Note: I'm using such env reference in key-auth plugin and it works just fine, but here it seems like it doesn't expect any other pattern than cert, and message/logs are not helpful.
### Expected Behavior
It's possible to setup ssls and provide cert location as env reference.
### Error Logs
_No response_
### Steps to Reproduce
Send following request to admin-api:
```
curl --location --request PUT 'http://127.0.0.1:9180/apisix/admin/ssls' \
--header 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
--header 'Content-Type: application/json' \
--data '{
"id": "some_id",
"type": "server",
"snis": ["localhost"],
"cert": "$ENV://APISIX_ENV_CERT",
"key": "$ENV://APISIX_ENV_KEY",
"ssl_protocols": ["TLSv1.2", "TLSv1.3"]
}'
```
### Environment
- APISIX version (run `apisix version`): 3.7.0
- Operating system (run `uname -a`): Linux 4091912aa453 6.6.16-linuxkit #1 SMP Fri Feb 16 11:54:02 UTC 2024 x86_64 GNU/Linux
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`): n/a
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`): 3.5.9
- APISIX Dashboard version, if relevant: n/a
- Plugin runner version, for issues related to plugin runners: n/a
- LuaRocks version, for installation issues (run `luarocks --version`): n/a
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop closed issue #11141: bug: unable to setup ssls with env reference
URL: https://github.com/apache/apisix/issues/11141
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-2051426685
anyone interested in taking this up can refer this piece of code:
https://github.com/shreemaan-abhishek/apisix/blob/1f775c8ace851a8b8862801ad35e7cf4cd00851f/apisix/schema_def.lua#L739
This is exactly where the bug is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "janiussyafiq (via GitHub)" <gi...@apache.org>.
janiussyafiq commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-3615504186
I was about to work in this issue as a first time contributor but it seems like the modification has been made in https://github.com/apache/apisix/blob/master/apisix/schema_def.lua (specifically on line 758).
Here's the piece of code:
```bash
local secret_uri_schema = {
type = "string",
pattern = "^\\$(secret|env|ENV)://"
}
```
Is there anything else that needs to be worked on for this issue or should it be closed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "kayx23 (via GitHub)" <gi...@apache.org>.
kayx23 commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-2050873272
From TEST18 in https://github.com/apache/apisix/blob/master/t/router/radixtree-sni2.t, it looks like it should be supported.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "LinkinStars (via GitHub)" <gi...@apache.org>.
LinkinStars commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-2056414486
> anyone interested in taking this up can refer this piece of code:
>
> https://github.com/shreemaan-abhishek/apisix/blob/1f775c8ace851a8b8862801ad35e7cf4cd00851f/apisix/schema_def.lua#L739
>
> This is exactly where the bug is.
@shreemaan-abhishek This looks easier to fix. I want to try it out. Do you think we need to support matching both uppercase and lowercase at the same time? I would think it's necessary to consider the users who are already using it. So, the `^\\$(secret|env|SECRET|ENV)://` would be better?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-2270580619
Should we support `SecReT` and `enV` support? I don't think we should add more ugliness to the world.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-2051011524
@Sebastian-Pietrzak this is a limitation (or a bug) with APISIX, using env reference will work as expected if you use the declaration in lower case. i.e `$env://` instead of `$ENV://` 😅
Would you like to fix this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "Sebastian-Pietrzak (via GitHub)" <gi...@apache.org>.
Sebastian-Pietrzak commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-2051028533
Thanks for checking! Knowing there's workaround is helpful. I think it would make sense to fix it at some point for consistency with other places, so that nobody will have issues with this anymore.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-2063993549
yep, LGTM
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: unable to setup ssls with env reference [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #11141:
URL: https://github.com/apache/apisix/issues/11141#issuecomment-3616073489
It appears to have been resolved at https://github.com/apache/apisix/pull/11339
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org