Skip to content

Commit 20c200b

Browse files
committed
fix: downgrade decrypt failure log from warn to info
During upgrades, when new fields are added to encrypt_fields, existing plaintext data in etcd will fail to decrypt. This is a normal and expected scenario, but the warn-level log generates noise that may alarm users. Downgrade the log level from warn to info for decrypt operations and add a hint message suggesting users re-save the configuration via Admin API to encrypt the plaintext values.
1 parent bda084d commit 20c200b

1 file changed

Lines changed: 13 additions & 8 deletions

File tree

apisix/plugin.lua

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -993,7 +993,12 @@ end
993993
-- - Arbitrary depth dotted paths (e.g., "a.b.c.d")
994994
-- - Array traversal at intermediate nodes (iterate each element)
995995
-- - Leaf type dispatch: string, array of strings, map of strings
996+
local decrypt_hint = ". This is expected after upgrading if the field was recently "
997+
.. "added to encrypt_fields; re-save the configuration via the Admin API to resolve."
998+
996999
local function process_encrypt_field(conf, key_path, operation, plugin_name, op_name)
1000+
local log_func = op_name == "decrypt" and core.log.info or core.log.warn
1001+
local hint = op_name == "decrypt" and decrypt_hint or ""
9971002
local dot_pos = core.string.find(key_path, ".")
9981003

9991004
if not dot_pos then
@@ -1006,8 +1011,8 @@ local function process_encrypt_field(conf, key_path, operation, plugin_name, op_
10061011
if type(val) == "string" then
10071012
local result, err = operation(val, "data_encrypt")
10081013
if not result then
1009-
core.log.warn("failed to ", op_name, " the conf of plugin [",
1010-
plugin_name, "] key [", key_path, "], err: ", err)
1014+
log_func("failed to ", op_name, " the conf of plugin [",
1015+
plugin_name, "] key [", key_path, "], err: ", err, hint)
10111016
else
10121017
conf[key_path] = result
10131018
end
@@ -1019,9 +1024,9 @@ local function process_encrypt_field(conf, key_path, operation, plugin_name, op_
10191024
if type(item) == "string" then
10201025
local result, err = operation(item, "data_encrypt")
10211026
if not result then
1022-
core.log.warn("failed to ", op_name, " the conf of plugin [",
1023-
plugin_name, "] key [", key_path,
1024-
"] index [", i, "], err: ", err)
1027+
log_func("failed to ", op_name, " the conf of plugin [",
1028+
plugin_name, "] key [", key_path,
1029+
"] index [", i, "], err: ", err, hint)
10251030
else
10261031
val[i] = result
10271032
end
@@ -1033,9 +1038,9 @@ local function process_encrypt_field(conf, key_path, operation, plugin_name, op_
10331038
if type(v) == "string" then
10341039
local result, err = operation(v, "data_encrypt")
10351040
if not result then
1036-
core.log.warn("failed to ", op_name, " the conf of plugin [",
1037-
plugin_name, "] key [", key_path,
1038-
".", k, "], err: ", err)
1041+
log_func("failed to ", op_name, " the conf of plugin [",
1042+
plugin_name, "] key [", key_path,
1043+
".", k, "], err: ", err, hint)
10391044
else
10401045
val[k] = result
10411046
end

0 commit comments

Comments
 (0)