Skip to content

feat: upgrade apisix-runtime to OpenResty 1.29.2.4#461

Closed
jarvis9443 wants to merge 10 commits into
masterfrom
nic/openresty-1.29.2.4-runtime
Closed

feat: upgrade apisix-runtime to OpenResty 1.29.2.4#461
jarvis9443 wants to merge 10 commits into
masterfrom
nic/openresty-1.29.2.4-runtime

Conversation

@jarvis9443
Copy link
Copy Markdown
Contributor

@jarvis9443 jarvis9443 commented May 20, 2026

Upgrade apisix-runtime from OpenResty 1.27.1.2 to 1.29.2.4.

This temporarily points apisix-nginx-module to the OpenResty 1.29.2.4 patch branch from api7/apisix-nginx-module#113 and pins the checkout to a concrete commit. It should be switched to the release tag once that patch set is merged and tagged.

This also carries a temporary ngx_multi_upstream_module patch for nginx 1.29.2 because the current 1.3.2 release only detects OpenResty up to 1.27.1. That local patch should be removed after ngx_multi_upstream_module ships 1.29.2 support.

Verification:

  • bash -n build-apisix-runtime.sh
  • docker build for apisix-runtime deb on Ubuntu noble amd64
  • applied the OpenResty 1.29.2.4 patch set locally and built nginx with apisix-nginx-module enabled

Summary by CodeRabbit

  • Chores
    • Updated OpenResty runtime to 1.29.2.4 and added recognition for 1.29.2 variants in build tooling.
    • Improved module acquisition with optional commit-level pinning and smarter clone/copy handling.
    • Adjusted OpenSSL installation steps for more reliable installs and refined patch application logic for compatible runtimes.
  • New Features
    • Added multi-upstream support in the runtime, enabling coordinated upstream connection/request handling.

Review Change Stack

Copilot AI review requested due to automatic review settings May 20, 2026 07:31
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 20, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4ce65cac-bebb-45e3-843f-cf80198720fb

📥 Commits

Reviewing files that changed from the base of the PR and between 635afaf and a45aa3a.

📒 Files selected for processing (1)
  • build-apisix-runtime.sh

📝 Walkthrough

Walkthrough

Bump OpenResty to 1.29.2.4, add apisix-nginx-module commit pinning and script-dir support, switch OpenSSL install targets, conditionally apply an nginx-1.29.2 ngx_multi_upstream patch, and update patch.sh to detect openresty-1.29.2.*.

Changes

Build Runtime Version and Commit Management

Layer / File(s) Summary
Version bumps and module commit variable
build-apisix-runtime.sh
OPENRESTY_VERSION and apisix-nginx-module defaults updated; new apisix_nginx_module_commit variable introduced.
OpenSSL install step
build-apisix-runtime.sh
Change OpenSSL install to sudo make install_sw install_ssldirs.
Script directory helper
build-apisix-runtime.sh
Add script_dir initialization for locating patch files.
Apply ngx_multi_upstream patch for 1.29.2
build-apisix-runtime.sh, patches/ngx_multi_upstream_module/*
When OPENRESTY_VERSION matches 1.29.2.*, copy and apply the nginx-1.29.2.patch into the OpenResty/nginx bundle before building.
apisix-nginx-module clone & commit checkout
build-apisix-runtime.sh
Distinguish cloned vs copied module sources; set clone ref based on commit pinning and fetch+checkout a specific commit when appropriate.

ngx_multi_upstream_module (nginx-1.29.2) Patch

Layer / File(s) Summary
patch.sh: openresty-1.29.2 detection
patches/ngx_multi_upstream_module/patch-sh-openresty-1.29.2.patch
Detect openresty-1.29.2.* and select nginx-1.29.2.patch with bundle/nginx-1.29.2 target.
Struct field additions for multi-upstream
patches/ngx_multi_upstream_module/nginx-1.29.2.patch
Add multi_c to ngx_connection_s; multi-upstream tracking fields to ngx_http_request_s and ngx_stream_session_s; multi/control fields to ngx_http_upstream_s and ngx_stream_upstream_t under T_NGX_MULTI_UPSTREAM.
ngx_http_upstream integration and control flow
patches/ngx_multi_upstream_module/nginx-1.29.2.patch
Include multi-upstream header/implementation into ngx_http_upstream.c; route connect/ssl/send/read/body/non-buffered/next/finalize flows to multi-upstream handlers when u->multi or fake multi connections are used.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ngx_http_upstream
  participant ngx_connection
  participant ngx_http_multi_upstream
  participant UpstreamPeer

  Client->>ngx_http_upstream: upstream request
  ngx_http_upstream->>ngx_connection: select peer connection (u->peer.connection)
  alt u->multi set
    ngx_connection->>ngx_http_multi_upstream: enqueue/reuse via multi handlers
    ngx_http_multi_upstream->>UpstreamPeer: manage backend multiplexing/connect
    UpstreamPeer-->>ngx_http_multi_upstream: connection/data
    ngx_http_multi_upstream-->>ngx_connection: signal reuse / NGX_DONE
    ngx_connection-->>ngx_http_upstream: multi read handlers return
  else normal path
    ngx_connection->>UpstreamPeer: direct connect/send
    UpstreamPeer-->>ngx_connection: response
    ngx_connection-->>ngx_http_upstream: normal read handler
  end
  ngx_http_upstream-->>Client: finalize request/response
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related issues

  • api7/api7-ee-3-gateway#1576: Both update OpenResty/nginx runtime and apply the ngx_multi_upstream_module patch against a newer OpenResty/nginx tree.

Possibly related PRs

Suggested reviewers

  • nic-6443

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Security Check ❌ Error Unvalidated environment variables in sed replacement string enable command injection if OPENSSL_PREFIX contains & or @ characters; default safe but exploitable if overridden. Use sed's -e flag with escaped variables: sed -i "s@# .include fipsmodule.cnf@.include $(printf '%s\n' "$OPENSSL_PREFIX" | sed -e 's/[\/&]/\\&/g')/ssl/fipsmodule.cnf@g"
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'feat: upgrade apisix-runtime to OpenResty 1.29.2.4' directly and concisely describes the primary change in the pull request, which is upgrading the OpenResty version in the build script.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review ✅ Passed Build infrastructure upgrade PR; E2E test check is inapplicable. Verification: script lint, docker builds, local testing with modules enabled.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch nic/openresty-1.29.2.4-runtime

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Upgrades the build-apisix-runtime.sh build script to target a newer OpenResty release (1.29.2.4) for building the APISIX runtime, along with aligning apisix-nginx-module to a compatible patch branch.

Changes:

  • Bump OpenResty version used by the runtime build from 1.27.1.2 to 1.29.2.4.
  • Update apisix-nginx-module reference from a release version to an OpenResty 1.29.2.4 patch branch.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread build-apisix-runtime.sh Outdated
Comment thread build-apisix-runtime.sh
Copilot AI review requested due to automatic review settings May 20, 2026 07:54
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comment thread build-apisix-runtime.sh Outdated
Comment thread build-apisix-runtime.sh
Copilot AI review requested due to automatic review settings May 20, 2026 08:07
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comment thread build-apisix-runtime.sh Outdated
Comment thread build-apisix-runtime.sh Outdated
Copilot AI review requested due to automatic review settings May 20, 2026 08:41
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comment thread build-apisix-runtime.sh Outdated
Comment thread patches/ngx_multi_upstream_module/nginx-1.29.2.patch Outdated
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (2)
patches/ngx_multi_upstream_module/nginx-1.29.2.patch (2)

198-207: 💤 Low value

Consider adjusting log level for normal finalization path.

Line 200 uses NGX_LOG_ERR for finalizing a fake multi-connection request. If this is a normal code path (not an actual error), NGX_LOG_INFO or NGX_LOG_DEBUG would be more appropriate to avoid log noise in production. If this is intentionally an error-only path, the current level is fine.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@patches/ngx_multi_upstream_module/nginx-1.29.2.patch` around lines 198 - 207,
The log call that reports finalization of a fake multi-connection request
currently uses NGX_LOG_ERR; if this is a normal/expected code path change the
log level to NGX_LOG_INFO or NGX_LOG_DEBUG to reduce noise (update the
ngx_log_error invocation in the block that checks u->multi and
ngx_http_multi_connection_fake(r)), otherwise leave as-is for true error
conditions; ensure you adjust the single call that logs "http finalize upstream
fake_r %p" and keep the rest of the flow that calls
ngx_http_multi_upstream_finalize_request(r->connection, rc) unchanged.

155-159: 💤 Low value

Inconsistent preprocessor conditional style.

Line 155 uses #if T_NGX_MULTI_UPSTREAM without parentheses, while all other occurrences in this patch use #if (T_NGX_MULTI_UPSTREAM). Consider using consistent style throughout.

♻️ Suggested style fix
-#if T_NGX_MULTI_UPSTREAM
+#if (T_NGX_MULTI_UPSTREAM)
             if (u->multi && rc == NGX_OK) {
                 ngx_multi_clean_leak(u->peer.connection);
             }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@patches/ngx_multi_upstream_module/nginx-1.29.2.patch` around lines 155 - 159,
The preprocessor conditional around the ngx_multi_clean_leak call is
inconsistent with the rest of the patch; change the directive from `#if
T_NGX_MULTI_UPSTREAM` to `#if (T_NGX_MULTI_UPSTREAM)` so it matches the existing
style used elsewhere. Update the conditional that guards the block checking
`u->multi && rc == NGX_OK` (which calls
`ngx_multi_clean_leak(u->peer.connection)`) to use the parenthesized macro form
`#if (T_NGX_MULTI_UPSTREAM)` and ensure the matching `#endif` remains unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@build-apisix-runtime.sh`:
- Around line 101-105: The patch file lookups in the OPENRESTY_VERSION branch
use $prev_workdir (references: ngx_multi_upstream_module_patch and prev_workdir)
which breaks local-source/module-repo runs; change those paths to be anchored to
the script's directory instead of the caller CWD by referencing the existing
script-dir variable (or compute SCRIPT_DIR via dirname "$0") and use that when
copying and when supplying the patch file to patch (targets: the cp of
"$prev_workdir/$ngx_multi_upstream_module_patch" and the patch input
"$prev_workdir/patches/ngx_multi_upstream_module/patch-sh-openresty-1.29.2.patch"
that feed ngx_multi_upstream_module-${ngx_multi_upstream_module_ver}).

In `@patches/ngx_multi_upstream_module/nginx-1.29.2.patch`:
- Around line 90-95: The connect-error branch currently logs the error and
returns without finalizing the HTTP upstream request; update the else branch
that logs "multi: connect return %i error" (uses variables rc and c) to finalize
the request before returning by invoking ngx_http_upstream_finalize_request(r,
u, NGX_HTTP_INTERNAL_SERVER_ERROR) (or ngx_http_finalize_request(r,
NGX_HTTP_INTERNAL_SERVER_ERROR) if upstream context doesn't exist) so the
request is properly completed and resources are released.

---

Nitpick comments:
In `@patches/ngx_multi_upstream_module/nginx-1.29.2.patch`:
- Around line 198-207: The log call that reports finalization of a fake
multi-connection request currently uses NGX_LOG_ERR; if this is a
normal/expected code path change the log level to NGX_LOG_INFO or NGX_LOG_DEBUG
to reduce noise (update the ngx_log_error invocation in the block that checks
u->multi and ngx_http_multi_connection_fake(r)), otherwise leave as-is for true
error conditions; ensure you adjust the single call that logs "http finalize
upstream fake_r %p" and keep the rest of the flow that calls
ngx_http_multi_upstream_finalize_request(r->connection, rc) unchanged.
- Around line 155-159: The preprocessor conditional around the
ngx_multi_clean_leak call is inconsistent with the rest of the patch; change the
directive from `#if T_NGX_MULTI_UPSTREAM` to `#if (T_NGX_MULTI_UPSTREAM)` so it
matches the existing style used elsewhere. Update the conditional that guards
the block checking `u->multi && rc == NGX_OK` (which calls
`ngx_multi_clean_leak(u->peer.connection)`) to use the parenthesized macro form
`#if (T_NGX_MULTI_UPSTREAM)` and ensure the matching `#endif` remains unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cc68cc99-2a86-4681-907a-5b6d3f457d90

📥 Commits

Reviewing files that changed from the base of the PR and between 165685c and d117201.

📒 Files selected for processing (3)
  • build-apisix-runtime.sh
  • patches/ngx_multi_upstream_module/nginx-1.29.2.patch
  • patches/ngx_multi_upstream_module/patch-sh-openresty-1.29.2.patch
✅ Files skipped from review due to trivial changes (1)
  • patches/ngx_multi_upstream_module/patch-sh-openresty-1.29.2.patch

Comment thread build-apisix-runtime.sh Outdated
Comment thread patches/ngx_multi_upstream_module/nginx-1.29.2.patch
Copilot AI review requested due to automatic review settings May 21, 2026 08:29
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

Comment thread build-apisix-runtime.sh
if [[ "$OPENRESTY_VERSION" == 1.29.2.* ]]; then
cp "$script_dir/$ngx_multi_upstream_module_patch" \
ngx_multi_upstream_module-${ngx_multi_upstream_module_ver}/nginx-1.29.2.patch
patch -d ngx_multi_upstream_module-${ngx_multi_upstream_module_ver} -p0 \
+ ngx_http_multi_upstream_finalize_request(c,
+ NGX_HTTP_INTERNAL_SERVER_ERROR);
+ ngx_log_error(NGX_LOG_ERR, c->log, 0,
+ "multi: upstream configured multi, but handler no support");
Comment on lines +156 to +161
} else {
+#if T_NGX_MULTI_UPSTREAM
+ if (u->multi && rc == NGX_OK) {
+ ngx_multi_clean_leak(u->peer.connection);
+ }
+#endif
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
patches/ngx_multi_upstream_module/nginx-1.29.2.patch (1)

75-95: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Complete the multi-connect result handling.

Line 75 only recognizes NGX_AGAIN and Line 81 only recognizes NGX_DONE, so an immediate NGX_OK from ngx_event_connect_peer() falls into the error path even though the connect succeeded. Also, the connect reuse unfinished branch at Line 88 just logs and then returns at Line 97, which leaves that request hanging. Please handle NGX_OK as a successful connect path and finalize/retry instead of returning after the unfinished-reuse log.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@patches/ngx_multi_upstream_module/nginx-1.29.2.patch` around lines 75 - 95,
The rc handling must treat NGX_OK as a successful connect (like NGX_AGAIN) and
must not leave requests hanging when reuse is unfinished: update the branch that
checks rc so that NGX_OK goes through the same successful-connect path as
NGX_AGAIN (set c->read->handler and c->write->handler to
ngx_http_multi_upstream_connect_handler, call ngx_add_timer with
u->conf->connect_timeout and log the connect), and in the ngx_done reuse branch
where ngx_multi_connected(c) is false, after logging "multi: connect reuse
unfinished %p" call ngx_http_multi_upstream_finalize_request(c,
NGX_HTTP_INTERNAL_SERVER_ERROR) (or trigger the existing retry/finalize
mechanism) instead of simply returning so the request is completed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@patches/ngx_multi_upstream_module/nginx-1.29.2.patch`:
- Around line 75-95: The rc handling must treat NGX_OK as a successful connect
(like NGX_AGAIN) and must not leave requests hanging when reuse is unfinished:
update the branch that checks rc so that NGX_OK goes through the same
successful-connect path as NGX_AGAIN (set c->read->handler and c->write->handler
to ngx_http_multi_upstream_connect_handler, call ngx_add_timer with
u->conf->connect_timeout and log the connect), and in the ngx_done reuse branch
where ngx_multi_connected(c) is false, after logging "multi: connect reuse
unfinished %p" call ngx_http_multi_upstream_finalize_request(c,
NGX_HTTP_INTERNAL_SERVER_ERROR) (or trigger the existing retry/finalize
mechanism) instead of simply returning so the request is completed.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2e92cdbe-8633-4eab-93ef-6392ea3dec0b

📥 Commits

Reviewing files that changed from the base of the PR and between d117201 and 635afaf.

📒 Files selected for processing (2)
  • build-apisix-runtime.sh
  • patches/ngx_multi_upstream_module/nginx-1.29.2.patch

@nic-6443 nic-6443 closed this May 22, 2026
@nic-6443 nic-6443 deleted the nic/openresty-1.29.2.4-runtime branch May 22, 2026 07:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants