nic-6443 opened a new pull request, #14018: URL: https://github.com/apache/apisix/pull/14018
### Description This lets consul discovery talk to Consul servers over https. Today `format_consul_params` only accepts `http://` addresses. An `https://` server fails registry startup with `only support consul http schema address`, and since that runs inside the init_worker / start path, discovery for it just never comes up. The scheme is now decided per server address, so one `servers` list can mix `http` and `https`. For https entries the client hands TLS to lua-resty-consul (`ssl = true`, `sni_host = <host>`, `ssl_verify = true`) at both places that build a client: the watch path (`get_opts`) and `fetch_services_from_server`. The certificate is checked against the host in the address. Trust comes from `lua_ssl_trusted_certificate`, i.e. `apisix.ssl.ssl_trusted_certificate`, the same way the nacos https support works. An https address without a port uses 443 (`parse_uri`'s default). I didn't add schema fields for skip-verify or a per-registry CA. Any other scheme is still rejected, with a message that now mentions https. One small side fix: `http.parse_uri` returns nil for a scheme other than http/https, so something like `tcp://...` used to crash in `unpack(nil)` instead of reaching that message. It now returns the error properly. `t/discovery/consul-tls.t` puts a TLS server block (test cert signed by `apisix.crt`) in front of the CI consul on 8500. It checks that a route with `discovery_type: consul` resolves through an `https://localhost:18501` server in both long and short connect mode, and it checks the per-address scheme handling and the rejection of other schemes. The docs for consul discovery and the `config.yaml.example` comment are updated too. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
