Current Behavior
I upgraded our test-env to Apisix 3.10. In the logging I have a lot of errors about decrypting config file:
`/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init_etcd
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:255: load_stream(): new plugins: {"ip-restriction":true,"limit-conn":true,"mqtt-proxy":true,"syslog":true}, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua`
Think it has something to do with "enable sensitive fields encryption by default". The plugins of the certain routes does still work (AFAIK) but I'm not sure if these errors are a problem. Also it spits all te sensitive information in de logging. I put the word "redacted" in logging above instead of the real secret. In the logging you can see "openid-connect" but this is also true for other plugins like "basic-auth". Also when changing/enable route the there errors also show up in logging.
Expected Behavior
At least not show the sensitive information in logging.
Also a way to mitigate these errors
Error Logs
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:255: load_stream(): new plugins: {"ip-restriction":true,"limit-conn":true,"mqtt-proxy":true,"syslog":true}, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua`
Steps to Reproduce
Starting up Apisix 3.10
Environment
- 3.10 ( apache/apisix:3.10.0-debian)
- 3.5.15 (bitnami/etcd:3.5.15)
Current Behavior
I upgraded our test-env to Apisix 3.10. In the logging I have a lot of errors about decrypting config file:
`/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init_etcd
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:255: load_stream(): new plugins: {"ip-restriction":true,"limit-conn":true,"mqtt-proxy":true,"syslog":true}, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua`
Think it has something to do with "enable sensitive fields encryption by default". The plugins of the certain routes does still work (AFAIK) but I'm not sure if these errors are a problem. Also it spits all te sensitive information in de logging. I put the word "redacted" in logging above instead of the real secret. In the logging you can see "openid-connect" but this is also true for other plugins like "basic-auth". Also when changing/enable route the there errors also show up in logging.
Expected Behavior
At least not show the sensitive information in logging.
Also a way to mitigate these errors
Error Logs
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:255: load_stream(): new plugins: {"ip-restriction":true,"limit-conn":true,"mqtt-proxy":true,"syslog":true}, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua
2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua
2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua`
Steps to Reproduce
Starting up Apisix 3.10
Environment