feat: support TLS connection with etcd.

[tokers]

What this PR does / why we need it:

Support the TLS connection when communicating with etcd cluster. We added a configuration item to custom the certificate verification. Whether to setup TLS connection or not depends on the endpoints' scheme, for instance, when endpoints are:

etcd:
  host:
    - "https://127.0.0.1:2379"
    - "https://127.0.0.1:3379"

APISIX will originate TLS connection automatically, and the Server Name Indication extention will be set by the endpoint host (127.0.0.1 in above case). Note by default APISIX will verify the certificate, close the verification in configuration explicitly if you want to bypass it.

etcd:
  tls:
    verfiy: false

Commits will be rebased after the changes are LGTM.

Pre-submission checklist:

• Did you explain what problem does this PR solve? Or what new features have been added?
• Have you added corresponding test cases?
• Have you modified the corresponding document?
• Is this PR backward compatible?

[membphis]

missing test case ^_^

[tokers]

Will add test cases after the corresponding pr in lua-resty-etcd is merged.

…

-- Zhang Chao

On 2020年10月28日 at 22:32:05, YuanSheng Wang ***@***.***) wrote: missing test case ^_^ — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2548 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACPR7LPLLIBF5UR7XRALZLDSNATOLANCNFSM4TB6Q56Q> .

[Miss-you]

I think we can also use the etcd proxy localily as an interim solution

[Apache APISIX -> etcd proxy(cert) ]--http mTLS-->[etcd]

[moonming]

I think we can also use the etcd proxy localily as an interim solution

[Apache APISIX -> etcd proxy(cert) ]--http mTLS-->[etcd]

Do you means add sidecar for etcd proxy(cert)?

[tokers]

I think we can also use the etcd proxy localily as an interim solution
[Apache APISIX -> etcd proxy(cert) ]--http mTLS-->[etcd]

Do you means add sidecar for etcd proxy(cert)?

I think not the sidecar but a "central bus", a bunch of etcd proxy instances to delegate the backend etcd cluster.
Actually it loses the real effect to use client certificate auth, since the proxy can be accessed by any users.

[tokers]

Will add test cases after the corresponding pr in lua-resty-etcd is merged.
…
-- Zhang Chao
On 2020年10月28日 at 22:32:05, YuanSheng Wang @.***) wrote: missing test case ^_^ — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2548 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACPR7LPLLIBF5UR7XRALZLDSNATOLANCNFSM4TB6Q56Q .

I have added some test cases.

[juzhiyuan]

We'd better keep far away from git force push if possible because this action will flush all review histories.

[tokers]

We'd better keep far away from git force push if possible because this action will flush all review histories.

OK.

[membphis]

we need more test cases.
After enabling TLS, confirm that we can successfully set/get route.

[tokers]

we need more test cases.
After enabling TLS, confirm that we can successfully set/get route.

Fair enough.

[tokers]

we need more test cases.
After enabling TLS, confirm that we can successfully set/get route.

@membphis Cases supplemented

[membphis]

@tokers merged, many thx for your contribution.