提两个建议

[Lewisyixin]

昨天为了解决后端转https导致连接池错乱的问题对apisix进行了升级，然后遇到了新的bug..
#7583
有几点想法想提一下：

1. apisix很多情况下会作为一个入口网关，重要程度不言而喻，因此类似这种数据格式所引起的bug能否做到让apisix启动不起来，就比如昨天我们升级后遇到的情况就是，所有开启http_to_https的路由都失效了，对于当前集群的影响还是比较大的，我个人观点是，启动报错再去排查能够有效的降低数据格式错误引起的这种大规模错误
2. redirect升级之后两个字段不能共存，接口提交会报错，但是dashboard里依然能够提交同时含有append_query_string和http_to_https的数据，所以我理解dashboard是直接往etcd写数据，并不是调用apisix接口，所以当任何一个接口增加了某一个字段的格式校验，dashboard都需要自己写一份同样的校验规则，我个人感觉这个出现类似问题的风险会很高，所以我觉得如果dashboard修改字段也是调用apisix接口的话可能会减少很多类似问题

[tokers]

apisix很多情况下会作为一个入口网关，重要程度不言而喻，因此类似这种数据格式所引起的bug能否做到让apisix启动不起来，就比如昨天我们升级后遇到的情况就是，所有开启http_to_https的路由都失效了，对于当前集群的影响还是比较大的，我个人观点是，启动报错再去排查能够有效的降低数据格式错误引起的这种大规模错误

That's impossible, how did you let a software know that it has a bug and reject the starting?

redirect升级之后两个字段不能共存，接口提交会报错，但是dashboard里依然能够提交同时含有append_query_string和http_to_https的数据，所以我理解dashboard是直接往etcd写数据，并不是调用apisix接口，所以当任何一个接口增加了某一个字段的格式校验，dashboard都需要自己写一份同样的校验规则，我个人感觉这个出现类似问题的风险会很高，所以我觉得如果dashboard修改字段也是调用apisix接口的话可能会减少很多类似问题

cc @bzp2010

[tzssangglass]

we have fixed this bug by: #7584, and this fix would be backport to 2.15.1

[Lewisyixin]

嗯，不过我想表达的不是单纯针对这个bug，而是根据这个bug延伸出的一些想法。就是作为一个入口网关的使用者，当我遇到类似我上面图中的schema错误时候，我宁愿程序异常退出，去人工校验错误数据，也不希望已经运行的路由条目启动之后都变成404而影响正常访问。

[tzssangglass]

in fact, we have plan to

1. make admin-API support dry-run model
2. limit that only APISIX control plane can write ETCD

This allows all updated data to be checked by the admin-API, but it still doesn't stop the interference of old data in ETCD.

我宁愿程序异常退出，去人工校验错误数据，也不希望已经运行的路由条目启动之后都变成404而影响正常访问。

I have some concerns: an error data will cause all APISIX instances down?
The consequences are the same as 404.
I would prefer to consider preemptive measures.

[Lewisyixin]

I didn't say error data will cause apisix instances down but the specified route invalid. What I mean is that "if apisix can return failure when checking there error data just on starting stage?"

Still take #7583 as example(I think it a good example in this sence).
When I upgrade apisix to 2.15.0 with error data, all route using plugin redirect which has both "append_query_string" and "http_to_https" on become invalid. If in prod env , it would be a serious issue.

"preemptive measures" is sure important, but can't ensure there are no error data(in #7583 error data is from plugin on last version)
As an important gateway entry, I just want to reduce the chance of issue like "all routes
invalid" when upgrading apisix, especially when upgrading version is happens sometimes.

[tzssangglass]

I didn't say error data will cause apisix instances down but the specified route invalid. What I mean is that "if apisix can return failure when checking there error data just on starting stage?"

SGTM, @spacewander @membphis @tokers what are your options?