Merge branch 'upstream/master' into github/master

* upstream/master: (77 commits)
  docs: Update admin-api.md (apache#10056)
  ci: fix a bug that can not open nginx.pid (apache#10061)
  feat: remove rust dependency by rollback lua-resty-ldap on master (apache#9936)
  docs: fix grpc-transcode.md error (apache#10059)
  feat: upgrade lua dependencies (apache#10051)
  fix: rollback lua-resty-session to 3.10 (apache#10046)
  feat: upgrade resty-redis-cluster from  1.02-4->1.05-1 (apache#10041)
  feat: update lua library (apache#10037)
  fix: worker not exited when executing quit or reload command (apache#9909)
  fix: traffic split plugin not validating upstream_id (apache#10008)
  ci: update the timeout value in cli.yml (apache#10026)
  fix(tencent-cloud-cls): DNS parsing failure (apache#9843)
  chore(deps): bump actions/setup-node from 3.7.0 to 3.8.0 (apache#10025)
  feat(openid-connect): add proxy_opts attribute (apache#9948)
  perf(log-rotate): replace string.sub with string.byte (apache#9984)
  fix(ci): replace github action in update-labels.yml (apache#9987)
  fix: can't sync etcd data if key has special character (apache#9967)
  perf(aws-lambda): cache the index of the array (apache#9944)
  fix: add support for dependency installation on endeavouros (apache#9985)
  chore(ci): automate management of unresponded issues (apache#9927)
  ...

.asf.yaml

@@ -53,6 +53,10 @@ github:
           dismiss_stale_reviews: true
           require_code_owner_reviews: true
           required_approving_review_count: 2
+      release/3.4:
+        required_pull_request_reviews:
+          require_code_owner_reviews: true
+          required_approving_review_count: 2
       release/3.3:
         required_pull_request_reviews:
           require_code_owner_reviews: true

.github/workflows/build.yml

@@ -28,7 +28,6 @@ jobs:
           - ubuntu-20.04
         os_name:
           - linux_openresty
-          - linux_openresty_1_19
         test_dir:
           - t/plugin/[a-k]*
           - t/plugin/[l-z]*

.github/workflows/cli.yml

@@ -31,7 +31,7 @@ jobs:
           - linux_apisix_current_luarocks_in_customed_nginx
 
     runs-on: ${{ matrix.platform }}
-    timeout-minutes: 15
+    timeout-minutes: 30
     env:
       SERVER_NAME: ${{ matrix.job_name }}
       OPENRESTY_VERSION: default

.github/workflows/close-unresponded.yml

@@ -0,0 +1,38 @@
+name: Check Issues
+
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: '0 10 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  prune_stale:
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+    name: Prune Unresponded
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+    - name: Prune Stale
+      uses: actions/stale@v8
+      with:
+        days-before-issue-stale: 14
+        days-before-issue-close: 3
+        stale-issue-message: >
+          Due to lack of the reporter's response this issue has been labeled with "no response".
+          It will be close in 3 days if no further activity occurs. If this issue is still
+          relevant, please simply write any comment. Even if closed, you can still revive the
+          issue at any time or discuss it on the [email protected] list.
+          Thank you for your contributions.
+        close-issue-message: >
+          This issue has been closed due to lack of activity. If you think that
+          is incorrect, or the issue requires additional review, you can revive the issue at
+          any time.
+        # Issues with these labels will never be considered stale.
+        only-labels: 'wait for update'
+        stale-issue-label: 'no response'
+        ascending: true

.github/workflows/doc-lint.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       - uses: actions/[email protected]
       - name: 🚀 Use Node.js
-        uses: actions/setup-node@v3.6.0
+        uses: actions/setup-node@v3.8.0
         with:
           node-version: "12.x"
       - run: npm install -g [email protected]

.github/workflows/kubernetes-ci.yml

@@ -28,7 +28,6 @@ jobs:
           - ubuntu-20.04
         os_name:
           - linux_openresty
-          - linux_openresty_1_19
 
     runs-on: ${{ matrix.platform }}
     timeout-minutes: 15

.github/workflows/lint.yml

@@ -33,7 +33,7 @@ jobs:
         uses: actions/[email protected]
 
       - name: Setup Nodejs env
-        uses: actions/setup-node@v3.6.0
+        uses: actions/setup-node@v3.8.0
         with:
           node-version: '12'
 

.github/workflows/tars-ci.yml

@@ -28,7 +28,6 @@ jobs:
           - ubuntu-20.04
         os_name:
           - linux_openresty
-          - linux_openresty_1_19
 
     runs-on: ${{ matrix.platform }}
     timeout-minutes: 15

.github/workflows/update-labels.yml

@@ -0,0 +1,30 @@
+name: Update label when user responds
+permissions:
+  issues: write
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  run-check:
+    if: ${{ !github.event.issue.pull_request }} # don't execute for PR comments
+    runs-on: ubuntu-latest
+    steps:
+      - name: update labels when user responds
+        uses: actions/github-script@v6
+        if: ${{ github.event.comment.user.login == github.event.issue.user.login && contains(github.event.issue.labels.*.name, 'wait for update') && !contains(github.event.issue.labels.*.name, 'user responded') }}
+        with:
+          script: |
+            github.rest.issues.addLabels({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              labels: ["user responded"]
+            })
+            github.rest.issues.removeLabel({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: "wait for update"
+            })

CHANGELOG.md

@@ -23,6 +23,7 @@ title: Changelog
 
 ## Table of Contents
 
+- [3.4.0](#340)
 - [3.3.0](#330)
 - [3.2.1](#321)
 - [3.2.0](#320)
@@ -70,6 +71,38 @@ title: Changelog
 - [0.7.0](#070)
 - [0.6.0](#060)
 
+## 3.4.0
+
+### Core
+
+- :sunrise: Support route-level MTLS [#9322](https://github.com/apache/apisix/pull/9322)
+- :sunrise: Support id schema for global_rules [#9517](https://github.com/apache/apisix/pull/9517)
+- :sunrise: Support use a single long http connection to watch all resources for etcd [#9456](https://github.com/apache/apisix/pull/9456)
+- :sunrise: Support max len 256 for ssl label [#9301](https://github.com/apache/apisix/pull/9301)
+
+### Plugins
+
+- :sunrise: Support multiple regex pattern matching for proxy_rewrite plugin [#9194](https://github.com/apache/apisix/pull/9194)
+- :sunrise: Add loki-logger plugin [#9399](https://github.com/apache/apisix/pull/9399)
+- :sunrise: Allow user configure DEFAULT_BUCKETS for prometheus plugin [#9673](https://github.com/apache/apisix/pull/9673)
+
+### Bugfixes
+
+- Fix(body-transformer): xml2lua: replace empty table with empty string [#9669](https://github.com/apache/apisix/pull/9669)
+- Fix: opentelemetry and grpc-transcode plugins cannot work together [#9606](https://github.com/apache/apisix/pull/9606)
+- Fix(skywalking-logger, error-log-logger): support $hostname in skywalking service_instance_name [#9401](https://github.com/apache/apisix/pull/9401)
+- Fix(admin): fix secrets do not support to update attributes by PATCH [#9510](https://github.com/apache/apisix/pull/9510)
+- Fix(http-logger): default request path should be '/' [#9472](https://github.com/apache/apisix/pull/9472)
+- Fix: syslog plugin doesn't work [#9425](https://github.com/apache/apisix/pull/9425)
+- Fix: wrong log format for splunk-hec-logging [#9478](https://github.com/apache/apisix/pull/9478)
+- Fix(etcd): reuse cli and enable keepalive [#9420](https://github.com/apache/apisix/pull/9420)
+- Fix: upstream key config add mqtt_client_id support [#9450](https://github.com/apache/apisix/pull/9450)
+- Fix: body-transformer plugin return raw body anytime [#9446](https://github.com/apache/apisix/pull/9446)
+- Fix(wolf-rbac): other plugin in consumer not effective when consumer used wolf-rbac plugin [#9298](https://github.com/apache/apisix/pull/9298)
+- Fix: always parse domain when host is domain name [#9332](https://github.com/apache/apisix/pull/9332)
+- Fix: response-rewrite plugin can't add only one character [#9372](https://github.com/apache/apisix/pull/9372)
+- Fix(consul): support to fetch only health endpoint [#9204](https://github.com/apache/apisix/pull/9204)
+
 ## 3.3.0
 
 **The changes marked with :warning: are not backward compatible.**

Makefile

@@ -158,14 +158,14 @@ check-rust:
 
 ### deps : Installing dependencies
 .PHONY: deps
-deps: check-rust runtime
+deps: runtime
 	$(eval ENV_LUAROCKS_VER := $(shell $(ENV_LUAROCKS) --version | grep -E -o "luarocks [0-9]+."))
 	@if [ '$(ENV_LUAROCKS_VER)' = 'luarocks 3.' ]; then \
 		mkdir -p ~/.luarocks; \
 		$(ENV_LUAROCKS) config $(ENV_LUAROCKS_FLAG_LOCAL) variables.OPENSSL_LIBDIR $(addprefix $(ENV_OPENSSL_PREFIX), /lib); \
 		$(ENV_LUAROCKS) config $(ENV_LUAROCKS_FLAG_LOCAL) variables.OPENSSL_INCDIR $(addprefix $(ENV_OPENSSL_PREFIX), /include); \
 		[ '$(ENV_OS_NAME)' == 'darwin' ] && $(ENV_LUAROCKS) config $(ENV_LUAROCKS_FLAG_LOCAL) variables.PCRE_INCDIR $(addprefix $(ENV_PCRE_PREFIX), /include); \
-		$(ENV_LUAROCKS) install rockspec/apisix-master-0.rockspec --tree=deps --only-deps --local $(ENV_LUAROCKS_SERVER_OPT); \
+		$(ENV_LUAROCKS) install rockspec/apisix-master-0.rockspec --tree deps --only-deps $(ENV_LUAROCKS_SERVER_OPT); \
 	else \
 		$(call func_echo_warn_status, "WARNING: You're not using LuaRocks 3.x; please remove the luarocks and reinstall it via https://raw.githubusercontent.com/apache/apisix/master/utils/linux-install-luarocks.sh"); \
 		exit 1; \

apisix/admin/init.lua

@@ -16,6 +16,7 @@
 --
 local require = require
 local core = require("apisix.core")
+local get_uri_args = ngx.req.get_uri_args
 local route = require("apisix.utils.router")
 local plugin = require("apisix.plugin")
 local v3_adapter = require("apisix.admin.v3_adapter")
@@ -174,7 +175,8 @@ local function run()
 
     if seg_res == "stream_routes" then
         local local_conf = core.config.local_conf()
-        if not local_conf.apisix.stream_proxy then
+        if local_conf.apisix.proxy_mode ~= "stream" and
+           local_conf.apisix.proxy_mode ~= "http&stream" then
             core.log.warn("stream mode is disabled, can not add any stream ",
                           "routes")
             core.response.exit(400, {error_msg = "stream mode is disabled, " ..
@@ -253,9 +255,16 @@ end
 
 local function get_plugins_list()
     set_ctx_and_check_token()
-
-    local plugins = resources.plugins.get_plugins_list()
-    core.response.exit(200, plugins)
+    local args = get_uri_args()
+    local subsystem = args["subsystem"]
+    -- If subsystem is passed then it should be either http or stream.
+    -- If it is not passed/nil then http will be default.
+    subsystem = subsystem or "http"
+    if subsystem == "http" or subsystem == "stream" then
+        local plugins = resources.plugins.get_plugins_list(subsystem)
+        core.response.exit(200, plugins)
+    end
+    core.response.exit(400,"invalid subsystem passed")
 end
 
 -- Handle unsupported request methods for the virtual "reload" plugin

apisix/admin/plugins.lua

@@ -18,11 +18,12 @@ local require   = require
 local core = require("apisix.core")
 local check_schema = require("apisix.plugin").check_schema
 local ipairs    = ipairs
-local pcall     = pcall
 local table_sort = table.sort
 local table_insert = table.insert
 local get_uri_args = ngx.req.get_uri_args
 local plugin_get_all = require("apisix.plugin").get_all
+local plugin_get_http = require("apisix.plugin").get
+local plugin_get_stream = require("apisix.plugin").get_stream
 local encrypt_conf = require("apisix.plugin").encrypt_conf
 local pairs = pairs
 
@@ -42,7 +43,15 @@ end
 
 function _M.get(name)
     local arg = get_uri_args()
-    if arg and arg["all"] == "true" then
+    -- If subsystem is passed inside args then it should be oneOf: http / stream.
+    local subsystem = arg["subsystem"] or "http"
+    if subsystem ~= "http" and subsystem ~= "stream" then
+        return 400, {error_msg = "unsupported subsystem: "..subsystem}
+    end
+
+    -- arg all to be deprecated
+    if (arg and arg["all"] == "true") then
+        core.log.warn("query parameter \"all\" will be deprecated soon.")
         local http_plugins, stream_plugins = plugin_get_all({
             version = true,
             priority = true,
@@ -60,16 +69,18 @@ function _M.get(name)
         return 200, http_plugins
     end
 
-    if not name then
-        return 400, {error_msg = "not found plugin name"}
-    end
+    local plugin
 
-    local plugin_name = "apisix.plugins." .. name
+    if subsystem == "http"  then
+        plugin = plugin_get_http(name)
+    else
+        plugin = plugin_get_stream(name)
+    end
 
-    local ok, plugin = pcall(require, plugin_name)
-    if not ok then
-        core.log.warn("failed to load plugin [", name, "] err: ", plugin)
-        return 400, {error_msg = "failed to load plugin " .. name}
+    if not plugin then
+        local err = "plugin not found in subsystem " .. subsystem
+        core.log.warn(err)
+        return 404, {error_msg = err}
     end
 
     local json_schema = plugin.schema
@@ -85,16 +96,34 @@ function _M.get(name)
 end
 
 
-function _M.get_plugins_list()
-    local plugins = core.config.local_conf().plugins
+function _M.get_plugins_list(subsystem)
+    local http_plugins
+    local stream_plugins
+    if subsystem == "http" then
+        http_plugins = core.config.local_conf().plugins
+    else
+        stream_plugins = core.config.local_conf().stream_plugins
+    end
+
     local priorities = {}
     local success = {}
-    for i, name in ipairs(plugins) do
-        local plugin_name = "apisix.plugins." .. name
-        local ok, plugin = pcall(require, plugin_name)
-        if ok and plugin.priority then
-            priorities[name] = plugin.priority
-            table_insert(success, name)
+    if http_plugins then
+        for i, name in ipairs(http_plugins) do
+            local plugin = plugin_get_http(name)
+            if plugin and plugin.priority then
+                priorities[name] = plugin.priority
+                table_insert(success, name)
+            end
+        end
+    end
+
+    if stream_plugins then
+        for i, name in ipairs(stream_plugins) do
+            local plugin = plugin_get_stream(name)
+            if plugin and plugin.priority then
+                priorities[name] = plugin.priority
+                table_insert(success, name)
+            end
         end
     end
 

apisix/admin/proto.lua

@@ -50,7 +50,7 @@ local function check_proto_used(plugins, deleting, ptype, pid)
         if type(plugins) == "table" and plugins["grpc-transcode"]
            and plugins["grpc-transcode"].proto_id
            and tostring(plugins["grpc-transcode"].proto_id) == deleting then
-            return false, {error_msg = "can not delete this proto,"
+            return false, {error_msg = "can not delete this proto, "
                                      .. ptype .. " [" .. pid
                                      .. "] is still using it now"}
         end

apisix/admin/resource.lua

@@ -230,7 +230,7 @@ function _M:put(id, conf, sub_path, args)
 end
 
 -- Keep the unused conf to make the args list consistent with other methods
-function _M:delete(id, conf, sub_path)
+function _M:delete(id, conf, sub_path, uri_args)
     if core.table.array_find(self.unsupported_methods, "delete") then
         return 405, {error_msg = "not supported `DELETE` method for " .. self.kind}
     end
@@ -253,7 +253,7 @@ function _M:delete(id, conf, sub_path)
 
     key = key .. "/" .. id
 
-    if self.delete_checker then
+    if self.delete_checker and uri_args.force ~= "true" then
         local code, err = self.delete_checker(id)
         if err then
             return code, err