moonming opened a new pull request, #14203: URL: https://github.com/apache/apisix/pull/14203
### Description This PR tightens how the Admin API matches the key of a request against `deployment.admin.admin_key`, and lets `apisix init` check the role of each key: - An empty key in a request (an empty `api_key` argument, `X-API-KEY` header or `x_api_key` cookie) is handled like a missing key, and an `admin_key` entry whose key is empty or missing matches no request. As before, APISIX generates a key at initialization for an empty key of the `admin` role. - A key gives access only with the role `admin` (read and write) or `viewer` (read only); a key with any other role value is refused. - `apisix init` refuses an `admin_key` entry whose role is not `admin` or `viewer`, or that is not a map. For an empty key of another role, its warning now says that the key matches no request, instead of saying that a key will be generated, which APISIX only does for the `admin` role. - The Admin API docs say which roles a key can have. #### Behavior change `apisix init` now fails for an `admin_key` entry whose role is not `admin` or `viewer`, including an entry without a role: ``` ERROR: the role of Admin API key <name> must be admin or viewer. ``` All configurations in `conf/`, the docs and the tests set one of these roles. #### Tests `t/cli/test_admin.sh` checks that `apisix init` refuses the role `Admin` and an entry without a role. Checked locally with the changed `apisix/cli/ops.lua` in the `apache/apisix:3.19.0-debian` image: both fail with that message, also when `allow_admin` is limited to `127.0.0.0/24`; a valid `admin` and `viewer` pair, and an empty key of the `admin` role (with the existing warning), start as before; `admin_key_required: false` skips the check. With the stock image, all of these start. #### Which issue(s) this PR fixes: There is no issue for it. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) The backward compatibility item is unchecked because of the behavior change above. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
