[nic-6443]

Description

The tls and keepalive_pool settings of an inline weighted_upstreams[].upstream in traffic-split are ignored. For tls, a client certificate is never sent and tls.verify / tls.ca_certs have no effect. For keepalive_pool, the connection pool to the upstream always uses the global nginx_config.http.upstream keepalive settings instead.

set_upstream in traffic-split builds the upstream from a fixed field list that included neither field. For keepalive_pool that is the whole story: the balancer reads keepalive_pool straight from ctx.upstream_conf in set_current_peer, so carrying the field over is enough.

For tls there were two more gaps:

• set_by_route returns early when traffic-split has already set upstream_conf, so the code that applies tls.verify, tls.ca_certs and the client certificate never ran for that upstream. That code is now a local function used by both paths.
• tls.client_cert_id was always resolved from the route's upstream (matched_upstream), not from the inline upstream traffic-split picked.

The docs now list tls and keepalive_pool as supported fields of the inline upstream.

New tests in t/plugin/traffic-split5.t cover client_cert/client_key, client_cert_id, verify + ca_certs (both an unrelated CA and the CA that issued the upstream certificate) and keepalive_pool on an inline upstream. Without the fix the first two get a 400 from the upstream (no client certificate), the unrelated CA gets a 200 instead of a verification failure, and the keepalive pool is created with the default size of 320 and keeps reusing the connection past the configured requests limit. The matching-CA case is the positive counterpart: there is no global trusted certificate in the test config, so it only returns 200 when the inline ca_certs is what the verification uses.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

• This line says inline-upstream tls is “the same as tls of an Upstream” but then enumerates a… · New
• The helper applies TLS settings for both https and grpcs schemes. Renaming it to a… · New
• There are multiple consecutive blank lines before TEST 13. Trimming these improves test readability… · New

What changed in this PR

Fixes traffic-split so TLS settings on inline weighted_upstreams[].upstream are actually applied (mTLS client certs, verify, ca_certs, and client_cert_id), and adds docs + tests to prevent regressions.

Changes:

• Propagates tls from inline upstream definitions and applies TLS options even when traffic-split pre-sets api_ctx.upstream_conf.
• Resolves tls.client_cert_id against the upstream actually selected (including inline upstreams).
• Adds documentation and new regression tests covering inline-upstream TLS behaviors.

File	Description
t/​plugin/​traffic-split5.t	Adds regression tests for inline-upstream TLS (mTLS + verify/CA).
docs/​zh/​latest/​plugins/​traffic-split.md	Documents tls as a supported inline-upstream field.
docs/​en/​latest/​plugins/​traffic-split.md	Documents tls as a supported inline-upstream field.
apisix/​upstream.lua	Refactors/apply TLS setup via shared helper, including traffic-split path.
apisix/​plugins/​traffic-split.lua	Ensures inline upstream tls is carried into the built upstream config.
apisix/​init.lua	Resolves client_cert_id from selected upstream (upstream_conf or matched).

_{Review effort: Lite}

[membphis]

LGTM

[membphis]

LGTM