AlinsRan commented on issue #2803:
URL:
https://github.com/apache/apisix-ingress-controller/issues/2803#issuecomment-5113408360
Thanks for the detailed write-up — it makes the answer easy to give
precisely.
## 1 & 3. Why the Admin API stream routes survive today (and why you should
not rely on it)
It is an artifact of the sync implementation, not a guarantee.
With `provider.type: apisix`, the controller syncs through ADC: ADC dumps
the current APISIX configuration and diffs it against the configuration the
controller owns. When ADC fetches `/apisix/admin/stream_routes`, it only keeps
a stream route if it has a `service_id`; a stream route with an inline
`upstream` and no service — exactly what your `curl` creates — is dropped
during the dump, so it never enters the diff and never gets deleted.
Two consequences:
- Nothing protects that route; it survives only because it is invisible to
the diff. Attach it to a service, or let ADC start handling service-less stream
routes, and it will be removed on the next full sync.
- With `provider.type: apisix-standalone` this does not apply at all — the
controller pushes a full configuration snapshot, so anything not generated from
CRDs is dropped.
So: not intentional, not a contract, and not something I would build a
production setup on.
## 2. `scheme: tls` for stream routes
The plumbing is already in place; the only blocker is CRD validation.
- `ApisixRoute` stream backends do pick up an `ApisixUpstream` with the same
name as the backend Service (`validateHTTPBackend` populates it,
`translateApisixRouteStreamBackend` merges it), and its `scheme` reaches the
generated upstream.
- Gateway API `TCPRoute` backends take `scheme` from `BackendTrafficPolicy`
in the same way.
Both CRDs restrict the field to `http|https|grpc|grpcs`, while APISIX itself
accepts `tcp|tls|udp` for L4 upstreams. That is why `scheme: tls` is rejected
by the CRD and `scheme: https` is accepted but meaningless at L4 — it is a
validation gap, not a data-plane limitation.
The fix is to allow the L4 schemes in those two fields. I will open a PR for
it and link it here. After that your case becomes:
```yaml
apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
name: my-service # same name as the backend Service
spec:
scheme: tls
```
or, on the Gateway API side, a `BackendTrafficPolicy` with `scheme: tls`
targeting the Service used by the `TCPRoute`.
Until that ships, the Admin API workaround will keep working as long as you
stay on `provider.type: apisix` and keep the stream route service-less — but
treat it as a temporary measure, not a supported configuration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
