Current Behavior
When a consumer is authenticated using a credential (e.g., via the key-auth plugin), any subsequent changes to that consumer's plugins or labels do not take effect for requests using that previously created credential.
It seems that the credential is bound to the consumer's configuration at the time the credential was created, and this state is cached in memory. As a result:
-
If the consumer is modified (e.g., plugins added/removed, labels updated), requests using the existing credential continue to reflect the old configuration.
-
If a new credential is created after the consumer is modified, the updated configuration is correctly applied to requests using this new credential.
-
If the APISIX instance is restarted, requests using the original credential then begin to reflect the updated configuration, suggesting the previous behavior is due to in-memory caching of consumer state at the time of credential creation.
What may cause an inconsistency is the lrucache: when credentials are attached to consumers via the /credentials endpoint, changes to the consumer do not seem to trigger cache invalidation. Therefore, the lrucache might continue serving outdated plugin configurations until it naturally expires or is manually refreshed.
Expected Behavior
Any changes made to the consumer’s plugins or labels should take effect immediately, even when the request is authenticated via a previously created credential.
Error Logs
No response
Steps to Reproduce
-
Create a consumer with zero or more plugins (e.g., limit-count, fault-injection) and/or labels.
-
Create a credential for the consumer. ( PUT consumers/consumer-id/credentials/credential-id)
-
Make authenticated requests using the credential — the plugins and labels work as expected.
-
Modify the consumer: add/remove plugins or update labels.
-
Make the same request again using the same credential.
-
The request still behaves according to the old configuration — plugins/labels are not updated.
Environment
- APISIX version (run
apisix version): 3.12 / 3.13
- Operating system (run
uname -a):
- OpenResty / Nginx version (run
openresty -V or nginx -V):
- etcd version, if relevant (run
curl http://127.0.0.1:9090/v1/server_info):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run
luarocks --version):
Current Behavior
When a consumer is authenticated using a credential (e.g., via the key-auth plugin), any subsequent changes to that consumer's plugins or labels do not take effect for requests using that previously created credential.
It seems that the credential is bound to the consumer's configuration at the time the credential was created, and this state is cached in memory. As a result:
If the consumer is modified (e.g., plugins added/removed, labels updated), requests using the existing credential continue to reflect the old configuration.
If a new credential is created after the consumer is modified, the updated configuration is correctly applied to requests using this new credential.
If the APISIX instance is restarted, requests using the original credential then begin to reflect the updated configuration, suggesting the previous behavior is due to in-memory caching of consumer state at the time of credential creation.
What may cause an inconsistency is the lrucache: when credentials are attached to consumers via the /credentials endpoint, changes to the consumer do not seem to trigger cache invalidation. Therefore, the lrucache might continue serving outdated plugin configurations until it naturally expires or is manually refreshed.
Expected Behavior
Any changes made to the consumer’s plugins or labels should take effect immediately, even when the request is authenticated via a previously created credential.
Error Logs
No response
Steps to Reproduce
Create a consumer with zero or more plugins (e.g., limit-count, fault-injection) and/or labels.
Create a credential for the consumer. ( PUT consumers/consumer-id/credentials/credential-id)
Make authenticated requests using the credential — the plugins and labels work as expected.
Modify the consumer: add/remove plugins or update labels.
Make the same request again using the same credential.
The request still behaves according to the old configuration — plugins/labels are not updated.
Environment
apisix version): 3.12 / 3.13uname -a):openresty -Vornginx -V):curl http://127.0.0.1:9090/v1/server_info):luarocks --version):