Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: set default value of ssl_trusted_certificate to system #11993

Open
wants to merge 36 commits into
base: master
Choose a base branch
from

Conversation

Revolyssup
Copy link
Contributor

@Revolyssup Revolyssup commented Feb 25, 2025

Description

When testing AI plugins, we found that ssl_trusted_certificate should be set to system, otherwise APISIX will continuously report errors when accessing external AI services.

unable to get local issuer certificate

Further refactoring:
Currently two ways are used for reading configuration.

  1. While generating nginx.conf file.read_yaml_conf is called
  2. During lifecycle, config_local.local_conf is called which calls read_yaml_conf internally.

The problem - Schema validation for configuration happens only in local_conf so at startup, the local conf schema is not validated. This is an inconsistency.

This is especially problematic when my change uses schema to set the default to "system" because this default is only set during lifecycle and not during generation of nginx.conf.

This PR moves the schema validation inside read_yaml_conf for consistency. Now local_conf is just calling read_yaml_conf internally and adding cache.

Effect on PR of refactoring

This makes sure that consistently at all places when yaml file is read, first schema validation happens which sets the default value of trusted certificate to "system" and then later the overrides take place including the one which replaces "system" with cert paths.

Based on the discussion below, this PR also removes support for combining multiple certs
Fixes # (issue)

Checklist

  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

@dosubot dosubot bot added size:M This PR changes 30-99 lines, ignoring generated files. enhancement New feature or request labels Feb 25, 2025
@dosubot dosubot bot added size:XS This PR changes 0-9 lines, ignoring generated files. and removed size:M This PR changes 30-99 lines, ignoring generated files. labels Feb 25, 2025
nic-6443
nic-6443 previously approved these changes Feb 25, 2025
@nic-6443 nic-6443 changed the title feat: use "system" as default when ssl_trusted_certificate not passed feat: set default value of ssl_trusted_certificate to system Feb 25, 2025
@nic-6443 nic-6443 changed the title feat: set default value of ssl_trusted_certificate to system feat: set default value of ssl_trusted_certificate to system Feb 25, 2025
nic-6443
nic-6443 previously approved these changes Feb 25, 2025
@dosubot dosubot bot added size:M This PR changes 30-99 lines, ignoring generated files. and removed size:XS This PR changes 0-9 lines, ignoring generated files. labels Feb 25, 2025
@dosubot dosubot bot added size:XS This PR changes 0-9 lines, ignoring generated files. and removed size:M This PR changes 30-99 lines, ignoring generated files. labels Feb 25, 2025
@dosubot dosubot bot added size:S This PR changes 10-29 lines, ignoring generated files. and removed size:XS This PR changes 0-9 lines, ignoring generated files. labels Feb 25, 2025
@Revolyssup Revolyssup dismissed stale reviews from membphis and nic-6443 via e1a3374 March 6, 2025 10:14
@dosubot dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. and removed size:M This PR changes 30-99 lines, ignoring generated files. labels Mar 7, 2025
@dosubot dosubot bot added size:M This PR changes 30-99 lines, ignoring generated files. and removed size:L This PR changes 100-499 lines, ignoring generated files. labels Mar 7, 2025
@dosubot dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. and removed size:M This PR changes 30-99 lines, ignoring generated files. labels Mar 7, 2025
@dosubot dosubot bot added size:M This PR changes 30-99 lines, ignoring generated files. and removed size:L This PR changes 100-499 lines, ignoring generated files. labels Mar 7, 2025
@dosubot dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. and removed size:M This PR changes 30-99 lines, ignoring generated files. labels Mar 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request size:L This PR changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants