Bump openresty to 1.21.4.3

.circleci/config.yml

@@ -105,7 +105,7 @@ executors:
   openresty:
     working_directory: /opt/app-root/apicast
     docker:
-      - image: quay.io/3scale/apicast-ci:openresty-1.19.3-23
+      - image: quay.io/3scale/apicast-ci:openresty-1.21.4-1
       - image: redis:3.2.8-alpine
     environment:
       TEST_NGINX_BINARY: openresty

CHANGELOG.md

@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 - Fixed 3scale Batcher policy unable to handle `app_id`/`access_token` contains special characters [PR #1457](https://github.com/3scale/APIcast/pull/1457) [THREESCALE-10934](https://issues.redhat.com/browse/THREESCALE-10934)
 
+### Added
+
+- Bump openresty to 1.21.4.3 [PR #1461](https://github.com/3scale/APIcast/pull/1461) [THREESCALE-10601](https://issues.redhat.com/browse/THREESCALE-10601)
+
 ## [3.15.0] 2024-04-04
 
 ### Fixed

Dockerfile

@@ -1,6 +1,6 @@
 FROM registry.access.redhat.com/ubi8:8.5
 
-ARG OPENRESTY_RPM_VERSION="1.19.3-23.el8"
+ARG OPENRESTY_RPM_VERSION="1.21.4-1.el8"
 ARG LUAROCKS_VERSION="2.3.0"
 ARG JAEGERTRACING_CPP_CLIENT_RPM_VERSION="0.3.1-13.el8"
 

Dockerfile.devel

@@ -1,6 +1,6 @@
 FROM registry.access.redhat.com/ubi8:8.5
 
-ARG OPENRESTY_RPM_VERSION="1.19.3-23.el8"
+ARG OPENRESTY_RPM_VERSION="1.21.4-1.el8"
 ARG LUAROCKS_VERSION="2.3.0"
 ARG JAEGERTRACING_CPP_CLIENT_RPM_VERSION="0.3.1-13.el8"
 

Makefile

@@ -13,7 +13,7 @@ NPROC ?= $(firstword $(shell nproc 2>/dev/null) 1)
 
 SEPARATOR="\n=============================================\n"
 
-DEVEL_IMAGE ?= quay.io/3scale/apicast-ci:openresty-1.19.3-23
+DEVEL_IMAGE ?= quay.io/3scale/apicast-ci:openresty-1.21.4-1
 DEVEL_DOCKERFILE ?= Dockerfile.devel
 
 RUNTIME_IMAGE ?= quay.io/3scale/apicast:latest
@@ -69,7 +69,7 @@ export COMPOSE_PROJECT_NAME
 #     docker push quay.io/3scale/apicast-ci:openresty-X.Y.Z-{release_number}
 # * update .circleci/config.yaml openresty executor with the image URL
 .PHONY: dev-build
-dev-build: export OPENRESTY_RPM_VERSION?=1.19.3
+dev-build: export OPENRESTY_RPM_VERSION?=1.21.4
 dev-build: export LUAROCKS_VERSION?=2.3.0
 dev-build: IMAGE_NAME ?= apicast-development:latest
 dev-build: ## Build development image

docker-compose-devel.yml

@@ -2,7 +2,7 @@
 version: '2.2'
 services:
   development:
-    image: ${IMAGE:-quay.io/3scale/apicast-ci:openresty-1.19.3-23}
+    image: ${IMAGE:-quay.io/3scale/apicast-ci:openresty-1.21.4-1}
     platform: "linux/amd64"
     depends_on:
       - redis

t/apicast-policy-3scale-batcher.t

@@ -401,7 +401,6 @@ auth cache on every request (see rewrite_by_lua_block).
 --- upstream env
   location /api-backend {
     rewrite_by_lua_block {
-      require('resty.ctx').apply()
       ngx.shared.cached_auths:flush_all()
     }
      echo 'yay, api backend';
@@ -583,7 +582,6 @@ auth cache on every request (see rewrite_by_lua_block).
 --- upstream env
   location /api-backend {
     rewrite_by_lua_block {
-      require('resty.ctx').apply()
       ngx.shared.cached_auths:flush_all()
     }
      echo 'yay, api backend';

t/apicast-policy-ip-check.t

@@ -360,6 +360,8 @@ is always the valid one.
 [403, 200]
 
 === TEST 11: X-forwarded-for header with invalid data
+From 1.21.1, nginx will always returns an error if spaces or control
+characters are used in a header name
 --- configuration
 {
   "services": [
@@ -385,11 +387,9 @@ is always the valid one.
 }
 --- request
 GET /
---- response_body
-IP address not allowed
 --- more_headers eval
 X-forwarded-for: ,9.9.9.9
---- error_code: 403
+--- error_code: 400
 --- no_error_log
 [error]
 
@@ -420,10 +420,8 @@ X-forwarded-for: ,9.9.9.9
 }
 --- request
 GET /
---- response_body
-IP address not allowed
 --- more_headers eval
 X-forwarded-for: ,
---- error_code: 403
+--- error_code: 400
 --- no_error_log
 [error]

t/apicast-policy-tls.t

@@ -76,7 +76,7 @@ content_by_lua_block {
 }
 --- response_body
 connected: 1
-ssl handshake: userdata
+ssl handshake: cdata
 HTTP/1.1 200 OK
 --- no_error_log
 [error]

t/listen-https.t

@@ -38,7 +38,7 @@ content_by_lua_block {
 }
 --- response_body
 connected: 1
-ssl handshake: userdata
+ssl handshake: cdata
 --- error_code: 200
 --- no_error_log
 [error]
@@ -110,7 +110,7 @@ content_by_lua_block {
 }
 --- response_body
 connected: 1
-ssl handshake: userdata
+ssl handshake: cdata
 --- error_code: 200
 --- no_error_log
 [error]
@@ -210,11 +210,11 @@ content_by_lua_block {
 }
 --- response_body
 connected: 1
-ssl handshake: userdata
+ssl handshake: cdata
 HTTP/1.1 201 Created
 
 connected: 1
-ssl handshake: userdata
+ssl handshake: cdata
 HTTP/1.1 202 Accepted
 --- error_code: 200
 --- grep_error_log eval: qr/Falling back to routing by host/