api: fix TLS when redirecting the request (#1740)

Signed-off-by: Ryan Leung <rleungx@gmail.com>

.gitignore

@@ -10,3 +10,4 @@ tags
 vendor
 default*
 *.bak
+.vscode/

server/api/redirector.go

@@ -14,10 +14,12 @@
 package api
 
 import (
+	"crypto/tls"
 	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strings"
+	"sync"
 
 	"github.com/pingcap/log"
 	"github.com/pingcap/pd/server"
@@ -34,6 +36,8 @@ const (
 	errRedirectToNotLeader = "redirect to not leader"
 )
 
+var initHTTPClientOnce sync.Once
+
 type redirector struct {
 	s *server.Server
 }
@@ -68,7 +72,20 @@ func (h *redirector) ServeHTTP(w http.ResponseWriter, r *http.Request, next http
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
-
+	initHTTPClientOnce.Do(func() {
+		var tlsConfig *tls.Config
+		tlsConfig, err = h.s.GetSecurityConfig().ToTLSConfig()
+		dialClient = &http.Client{
+			Transport: &http.Transport{
+				DisableKeepAlives: true,
+				TLSClientConfig:   tlsConfig,
+			},
+		}
+	})
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
 	newCustomReverseProxies(urls).ServeHTTP(w, r)
 }
 

tests/pdctl/cluster/cluster_test.go

@@ -71,6 +71,7 @@ func (s *clusterTestSuite) TestClusterAndPing(c *C) {
 	temp.Close()
 	os.Stdout = old
 	out, _ := ioutil.ReadFile(fname)
+	os.Remove(fname)
 	c.Assert(strings.Contains(string(out), "no such file or directory"), IsTrue)
 
 	// cluster status

tests/pdctl/region/region_test.go

@@ -68,6 +68,7 @@ func (s *regionTestSuite) TestRegionKeyFormat(c *C) {
 	temp.Close()
 	os.Stdout = old
 	out, _ := ioutil.ReadFile(fname)
+	os.Remove(fname)
 	c.Assert(strings.Contains(string(out), "unknown flag"), IsFalse)
 }