feat(cli): support bypassing Admin API Auth by configuration

apisix/admin/init.lua

@@ -32,6 +32,7 @@ local reload_event = "/apisix/admin/plugins/reload"
 local ipairs = ipairs
 local error = error
 local type = type
+local getenv = os.getenv
 
 
 local events
@@ -66,6 +67,12 @@ local router
 
 
 local function check_token(ctx)
+    -- check if APISIX_BYPASS_ADMIN_API_AUTH=true
+    local bypass_admin_api_auth = getenv("APISIX_BYPASS_ADMIN_API_AUTH")
+    if bypass_admin_api_auth == "true" then
+        return true
+    end
+
     local local_conf = core.config.local_conf()
     local admin_key = core.table.try_read_attr(local_conf, "deployment", "admin", "admin_key")
     if not admin_key then
@@ -395,6 +402,14 @@ function _M.init_worker()
     events.register(reload_plugins, reload_event, "PUT")
 
     if ngx_worker_id() == 0 then
+        -- check if APISIX_BYPASS_ADMIN_API_AUTH=true
+        local bypass_admin_api_auth = getenv("APISIX_BYPASS_ADMIN_API_AUTH")
+        if bypass_admin_api_auth == "true" then
+            core.log.warn("AdminKey is bypassed because of APISIX_BYPASS_ADMIN_API_AUTH=true.",
+                "If you are deploying APISIX in a production environment,",
+                "please disable it and set a secure password for the adminKey!")
+        end
+
         local ok, err = ngx_timer_at(0, function(premature)
             if premature then
                 return

apisix/cli/ngx_tpl.lua

@@ -51,6 +51,8 @@ worker_shutdown_timeout {* worker_shutdown_timeout *};
 env APISIX_PROFILE;
 env PATH; # for searching external plugin runner's binary
 
+env APISIX_BYPASS_ADMIN_API_AUTH; # bypass admin api auth
+
 # reserved environment variables for configuration
 env APISIX_DEPLOYMENT_ETCD_HOST;
 

apisix/cli/ops.lua

@@ -190,6 +190,15 @@ local function init(env)
         checked_admin_key = true
     end
 
+    -- check if APISIX_BYPASS_ADMIN_API_AUTH=true
+    local bypass_admin_api_auth = getenv("APISIX_BYPASS_ADMIN_API_AUTH")
+    if bypass_admin_api_auth == "true" then
+        checked_admin_key = true
+        print("Warning! AdminKey is bypassed because of APISIX_BYPASS_ADMIN_API_AUTH=true.",
+            "If you are deploying APISIX in a production environment,",
+            "please disable it and set a secure password for the adminKey!")
+    end
+
     if yaml_conf.apisix.enable_admin and not checked_admin_key then
         local help = [[
 

t/admin/token.t

@@ -177,3 +177,30 @@ PUT /apisix/admin/plugins/reload?api_key=4054f7cf07e344346cd3f287985e76a2
 --- request
 GET /apisix/admin/routes??api_key=4054f7cf07e344346cd3f287985e76a2
 --- error_code: 401
+
+
+
+=== TEST 10: access without api key
+--- request
+GET /apisix/admin/routes
+--- error_code: 401
+
+
+
+=== TEST 11: access without api key, but APISIX_BYPASS_ADMIN_API_AUTH=true
+--- main_config
+env APISIX_BYPASS_ADMIN_API_AUTH=true;
+--- request
+GET /apisix/admin/routes
+--- error_code: 200
+--- error_log
+AdminKey is bypassed because of APISIX_BYPASS_ADMIN_API_AUTH=true
+
+
+
+=== TEST 12: access without api key, but APISIX_BYPASS_ADMIN_API_AUTH=non-true
+--- main_config
+env APISIX_BYPASS_ADMIN_API_AUTH=non-true;
+--- request
+GET /apisix/admin/routes
+--- error_code: 401

t/cli/test_admin.sh

@@ -189,6 +189,32 @@ fi
 
 echo "pass: missing admin key and only allow 127.0.0.0/24 to access admin api"
 
+# allow any IP to access admin api with empty admin_key, when APISIX_BYPASS_ADMIN_API_AUTH=true
+
+git checkout conf/config.yaml
+
+echo '
+deployment:
+  admin:
+    admin_key: ~
+    allow_admin:
+      - 0.0.0.0/0
+' > conf/config.yaml
+
+APISIX_BYPASS_ADMIN_API_AUTH=true make init > output.log 2>&1 | true
+
+if grep -E "ERROR: missing valid Admin API token." output.log > /dev/null; then
+    echo "failed: should not show 'ERROR: missing valid Admin API token.'"
+    exit 1
+fi
+
+if ! grep -E "Warning! AdminKey is bypassed" output.log > /dev/null; then
+    echo "failed: should show 'Warning! AdminKey is bypassed'"
+    exit 1
+fi
+
+echo "pass: allow empty admin_key, when APISIX_BYPASS_ADMIN_API_AUTH=true"
+
 # admin api, allow any IP but use default key
 
 echo '