Struct UpstreamPlugin 

pub struct UpstreamPlugin {
    balancer: Balancer,
    client: Arc<OutboundClient>,
    timeout: Duration,
    tls: bool,
    ssl_verify: bool,
    tls_identity: Option<Arc<UpstreamTls>>,
}

Proxies the request to one of the configured backend targets and populates Context.response with the upstream’s status, headers, and body.

Connection failures, request-build failures, and body-read failures are returned as PluginExecutionErrors so the graph engine can route them through this node’s error port.

Fields

balancer: Balancer

Backend pool + load-balancing strategy (shared with the L4 stream proxy).

client: Arc<OutboundClient>

Shared pooled HTTP client (from PluginResources).

timeout: Duration

Whole-call deadline per proxied request.

tls: bool

Connect to the upstream over TLS (https/wss); default false.

ssl_verify: bool

Verify the upstream’s TLS certificate; default true. Only meaningful when tls is set.

tls_identity: Option<Arc<UpstreamTls>>

Per-upstream TLS identity (client cert / private CA); None = shared clients, exactly the pre-mTLS behavior.

Implementations

impl UpstreamPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• targets (array of {host: string, port: integer}, required): the backend pool. Entries missing host or port are skipped; an empty resulting pool is a config error.

• load_balancing (string, default round_robin): one of round_robin, least_connections, or ip_hash. Hyphenated and short spellings (round-robin, least-conn) are accepted, as is the legacy key name load_balancer (see Strategy::parse).

• timeout_ms (integer, default 60000): whole-call deadline (connect + request + response body) per proxied request; exceeding it fails the node with UPSTREAM_TIMEOUT through the error port.

• tls (bool, default false): connect to the upstream over TLS (https for the buffered path, wss for WebSocket).

• ssl_verify (bool, default true): verify the upstream’s TLS certificate. Only meaningful when tls is set.

• client_cert_path / client_key_path (string, optional): PEM client certificate and private key presented to the upstream for mutual TLS. Must be set together, and only with tls: true.

• ca_cert_path (string, optional): PEM CA bundle used to verify the upstream’s certificate, replacing the native root store for this upstream. Requires tls: true; rejected together with ssl_verify: false (a CA bundle to verify with is contradictory when verification is off).

Errors if no valid target is configured, if the load-balancing value is not a string, if it names an unknown strategy, if any mTLS key is set without tls: true, if client_cert_path/client_key_path are not both set, if ca_cert_path is set with ssl_verify: false, or if the configured cert/key/CA files can’t be read or parsed.

type: upstream
config:
  targets:
    - host: backend-1
      port: 3000
    - host: backend-2
      port: 3000
  load_balancing: least_connections
  timeout_ms: 60000
  tls: true
  client_cert_path: /etc/gateway/client.crt
  client_key_path: /etc/gateway/client.key
  ca_cert_path: /etc/gateway/ca.crt

Trait Implementations

impl Debug for UpstreamPlugin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Plugin for UpstreamPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.