in kong/kong/runloop/handler.lua [916:1020]
function balancer_prepare(ctx, scheme, host_type, host, port,
service, route)
sleep_once_for_balancer_init()
local retries
local connect_timeout
local send_timeout
local read_timeout
if service then
retries = service.retries
connect_timeout = service.connect_timeout
send_timeout = service.write_timeout
read_timeout = service.read_timeout
end
local balancer_data = {
scheme = scheme,
type = host_type,
host = host,
port = port,
try_count = 0,
retries = retries or 5,
connect_timeout = connect_timeout or 60000,
send_timeout = send_timeout or 60000,
read_timeout = read_timeout or 60000,
tries = setmetatable({}, ARRAY_MT),
}
ctx.service = service
ctx.route = route
ctx.balancer_data = balancer_data
if is_http_module and service then
local res, err
local client_certificate = service.client_certificate
if client_certificate then
local cert, err = get_certificate(client_certificate)
if not cert then
log(ERR, "unable to fetch upstream client TLS certificate ",
client_certificate.id, ": ", err)
return
end
res, err = set_upstream_cert_and_key(cert.cert, cert.key)
if not res then
log(ERR, "unable to apply upstream client TLS certificate ",
client_certificate.id, ": ", err)
end
end
local tls_verify = service.tls_verify
if tls_verify then
res, err = set_upstream_ssl_verify(tls_verify)
if not res then
log(CRIT, "unable to set upstream TLS verification to: ",
tls_verify, ", err: ", err)
end
end
local tls_verify_depth = service.tls_verify_depth
if tls_verify_depth then
res, err = set_upstream_ssl_verify_depth(tls_verify_depth)
if not res then
log(CRIT, "unable to set upstream TLS verification to: ",
tls_verify, ", err: ", err)
return kong.response.exit(500)
end
end
local ca_certificates = service.ca_certificates
if ca_certificates then
res, err = get_ca_certificate_store(ca_certificates)
if not res then
log(CRIT, "unable to get upstream TLS CA store, err: ", err)
else
res, err = set_upstream_ssl_trusted_store(res)
if not res then
log(CRIT, "unable to set upstream TLS CA store, err: ", err)
end
end
end
end
if is_stream_module and scheme == "tcp" then
local res, err = disable_proxy_ssl()
if not res then
log(ERR, "unable to disable upstream TLS handshake: ", err)
end
end
end