Merge pull request #9539 from terry-xiaoyu/protect_rule_and_resource_crud_apis-v44

Protect rule and resource crud apis v44
2022-12-14 16:00:15 +08:00 · 2022-12-14 16:00:15 +08:00 · 81560381c8
parent 7221909726 920a9fd455
commit 81560381c8
5 changed files with 175 additions and 21 deletions
--- a/apps/emqx_rule_engine/src/emqx_rule_engine.appup.src
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine.appup.src
@ -3,6 +3,9 @@
 {VSN,
  [{"4.4.11",[
    {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
+    {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+    {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+    {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
    {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}
   ]},
   {"4.4.10",
@ -11,6 +14,8 @@
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
@ -19,7 +24,6 @@
     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
   {"4.4.9",
    [{add_module,emqx_rule_engine_jwt},
@ -27,6 +31,8 @@
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
@ -35,7 +41,6 @@
     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
   {"4.4.8",
@ -44,6 +49,8 @@
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
@ -51,7 +58,6 @@
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
@ -61,6 +67,8 @@
     {add_module,emqx_rule_engine_jwt_worker},
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
@ -68,7 +76,6 @@
     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
@ -79,6 +86,8 @@
     {add_module,emqx_rule_engine_jwt_worker},
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
@ -91,13 +100,14 @@
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]}]},
+     {load_module,emqx_rule_validator,brutal_purge,soft_purge,[]}]},
   {"4.4.4",
    [{add_module,emqx_rule_engine_jwt},
     {add_module,emqx_rule_engine_jwt_worker},
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
@ -105,7 +115,6 @@
     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
@ -117,6 +126,8 @@
     {add_module,emqx_rule_engine_jwt_worker},
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
@ -131,13 +142,14 @@
     {add_module,emqx_rule_date},
     {load_module,emqx_rule_maps,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]}]},
+     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
   {"4.4.2",
    [{add_module,emqx_rule_engine_jwt},
     {add_module,emqx_rule_engine_jwt_worker},
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
@ -153,13 +165,14 @@
     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
     {add_module,emqx_rule_date},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
   {"4.4.1",
    [{add_module,emqx_rule_engine_jwt},
     {add_module,emqx_rule_engine_jwt_worker},
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
@ -171,7 +184,6 @@
     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
@ -182,6 +194,8 @@
     {add_module,emqx_rule_engine_jwt_worker},
     {add_module,emqx_rule_engine_jwt_sup},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
     {apply,{emqx_rule_engine_sup,start_jwt_sup,[]}},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
@ -197,15 +211,18 @@
     {update,emqx_rule_metrics,{advanced,["4.4.0"]}},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
-     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]}]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]}]},
   {<<".*">>,[]}],
  [{"4.4.11",[
    {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
+    {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
+    {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+    {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
    {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}
   ]},
   {"4.4.10",
    [{load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
@ -223,6 +240,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.9",
    [{load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
@ -241,6 +259,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.8",
    [{load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
@ -260,6 +279,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {<<"4\\.4\\.[6-7]">>,
    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@ -279,6 +299,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.5",
    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@ -299,6 +320,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.4",
    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@ -319,6 +341,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.3",
    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
@ -341,6 +364,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.2",
    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
@ -364,6 +388,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.1",
    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
@ -387,6 +412,7 @@
     {delete_module,emqx_rule_engine_jwt}]},
   {"4.4.0",
    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
     {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
     {load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
--- a/apps/emqx_rule_engine/src/emqx_rule_engine_api.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine_api.erl
@ -16,6 +16,8 @@

 -module(emqx_rule_engine_api).

+-behaviour(gen_server).
+
 -include("rule_engine.hrl").
 -include_lib("emqx/include/logger.hrl").

@ -156,6 +158,17 @@
            descr  => "List all events with detailed info"
           }).

+-export([start_link/0]).
+
+% gen_server Callbacks
+-export([ init/1
+        , handle_call/3
+        , handle_cast/2
+        , handle_info/2
+        , terminate/2
+        , code_change/3
+        ]).
+
 -export([ create_rule/2
        , update_rule/2
        , list_rules/2
@ -207,10 +220,90 @@
            <<"Bad Arguments: ", R0/binary>>
        end).

+-define(T_CALL, 30000).
+
+start_link() ->
+    %% The caller process (the cowboy process serves the HTTP request) may times out and dies
+    %% before some time-consuming operations complete, e.g. creating rules/resources or testing
+    %% the connectivity on unreachable resources.
+    %% To avoid this problem, we delegate the operations to a gen_server.
+    gen_server:start_link({local, ?MODULE}, ?MODULE, [], []).
+
+create_rule(_Bindings, Params) ->
+    delegate_call({create_rule, _Bindings, Params}).
+
+update_rule(_Bindings, Params) ->
+    delegate_call({update_rule, _Bindings, Params}).
+
+delete_rule(_Bindings, Params) ->
+    delegate_call({delete_rule, _Bindings, Params}).
+
+create_resource(_Bindings, Params) ->
+    delegate_call({create_resource, _Bindings, Params}).
+
+update_resource(_Bindings, Params) ->
+    delegate_call({update_resource, _Bindings, Params}).
+
+start_resource(_Bindings, Params) ->
+    delegate_call({start_resource, _Bindings, Params}).
+
+delete_resource(_Bindings, Params) ->
+    delegate_call({delete_resource, _Bindings, Params}).
+
+%% delegate API calls to a single process.
+delegate_call(Req) ->
+    gen_server:call(?MODULE, Req, ?T_CALL).
+
+%%------------------------------------------------------------------------------
+%% gen_server callbacks
+%%------------------------------------------------------------------------------
+
+init([]) ->
+    {ok, #{}}.
+
+handle_call({create_rule, _Bindings, Params}, _From, State) ->
+    {reply, delegate_create_rule(_Bindings, Params), State};
+
+handle_call({update_rule, _Bindings, Params}, _From, State) ->
+    {reply, delegate_update_rule(_Bindings, Params), State};
+
+handle_call({delete_rule, _Bindings, Params}, _From, State) ->
+    {reply, delegate_delete_rule(_Bindings, Params), State};
+
+handle_call({create_resource, _Bindings, Params}, _From, State) ->
+    {reply, delegate_create_resource(_Bindings, Params), State};
+
+handle_call({start_resource, _Bindings, Params}, _From, State) ->
+    {reply, delegate_start_resource(_Bindings, Params), State};
+
+handle_call({update_resource, _Bindings, Params}, _From, State) ->
+    {reply, delegate_update_resource(_Bindings, Params), State};
+
+handle_call({delete_resource, _Bindings, Params}, _From, State) ->
+    {reply, delegate_delete_resource(_Bindings, Params), State};
+
+handle_call(Req, _From, State) ->
+    ?LOG(error, "unexpected call: ~p", [Req]),
+    {reply, ignored, State}.
+
+handle_cast(Msg, State) ->
+    ?LOG(error, "unexpected cast: ~p", [Msg]),
+    {noreply, State}.
+
+handle_info(Info, State) ->
+    ?LOG(error, "unexpected info: ~p", [Info]),
+    {noreply, State}.
+
+terminate(_Reason, _State) ->
+    ok.
+
+code_change(_OldVsn, State, _Extra) ->
+    {ok, State}.
+
 %%------------------------------------------------------------------------------
 %% Rules API
 %%------------------------------------------------------------------------------
-create_rule(_Bindings, Params) ->
+delegate_create_rule(_Bindings, Params) ->
    if_test(fun() -> test_rule_sql(Params) end,
            fun() -> do_create_rule(Params) end,
            Params).
@ -250,7 +343,7 @@ do_create_rule2(ParsedParams) ->
            return({error, 400, ?ERR_BADARGS(Reason)})
    end.

-update_rule(#{id := Id0}, Params) ->
+delegate_update_rule(#{id := Id0}, Params) ->
    Id = urldecode(Id0),
    case parse_rule_params(Params, #{id => Id}) of
        {ok, ParsedParams} ->
@ -280,7 +373,7 @@ show_rule(#{id := Id0}, _Params) ->
    Id = urldecode(Id0),
    reply_with(fun emqx_rule_registry:get_rule/1, Id).

-delete_rule(#{id := Id0}, _Params) ->
+delegate_delete_rule(#{id := Id0}, _Params) ->
    Id = urldecode(Id0),
    ok = emqx_rule_engine:delete_rule(Id),
    return(ok).
@ -309,7 +402,7 @@ show_action(#{name := Name}, _Params) ->
 %%------------------------------------------------------------------------------
 %% Resources API
 %%------------------------------------------------------------------------------
-create_resource(#{}, Params) ->
+delegate_create_resource(#{}, Params) ->
    case parse_resource_params(Params) of
        {ok, ParsedParams} ->
            if_test(fun() -> do_create_resource(test_resource, maps:without([id], ParsedParams)) end,
@ -382,7 +475,7 @@ get_resource_status(#{id := Id0}, _Params) ->
            return({error, 400, ?ERR_NO_RESOURCE(Id)})
    end.

-start_resource(#{id := Id0}, _Params) ->
+delegate_start_resource(#{id := Id0}, _Params) ->
    Id = urldecode(Id0),
    case emqx_rule_engine:start_resource(Id) of
        ok ->
@ -394,7 +487,7 @@ start_resource(#{id := Id0}, _Params) ->
            return({error, 400, ?ERR_BADARGS(Reason)})
    end.

-update_resource(#{id := Id0}, NewParams) ->
+delegate_update_resource(#{id := Id0}, NewParams) ->
    Id = urldecode(Id0),
    P1 = case proplists:get_value(<<"description">>, NewParams) of
        undefined -> #{};
@ -419,7 +512,7 @@ update_resource(#{id := Id0}, NewParams) ->
            return({error, 400, ?ERR_BADARGS(Reason)})
    end.

-delete_resource(#{id := Id0}, _Params) ->
+delegate_delete_resource(#{id := Id0}, _Params) ->
    Id = urldecode(Id0),
    case emqx_rule_engine:delete_resource(Id) of
        ok -> return(ok);
--- a/apps/emqx_rule_engine/src/emqx_rule_engine_sup.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine_sup.erl
@ -24,6 +24,8 @@

 -export([ start_locker/0
        , start_jwt_sup/0
+        , ensure_api_delegator_started/0
+        , ensure_api_delegator_stopped/0
        ]).

 -export([init/1]).
@ -58,7 +60,8 @@ init([]) ->
                type => worker,
                modules => [emqx_rule_monitor]},
    JWTSup = jwt_sup_child_spec(),
-    {ok, {SupFlags, [Registry, Metrics, Monitor, JWTSup]}}.
+    API = api_delegator_sup_spec(),
+    {ok, {SupFlags, [Registry, Metrics, Monitor, JWTSup, API]}}.

 start_locker() ->
    Locker = #{id => emqx_rule_locker,
@ -97,3 +100,31 @@ ensure_table(Name, Opts) ->
        error:badarg ->
            ok
    end.
+
+%% This is called by the emqx_rule_engine.appup.src when release upgrade
+ensure_api_delegator_started() ->
+    case supervisor:start_child(?MODULE, api_delegator_sup_spec()) of
+        {ok, _} -> ok;
+        {error, already_present} -> ok;
+        {error, {already_started, _Pid}} -> ok;
+        {error, _} = Err -> throw({failed_to_start_ensure_api, Err})
+    end.
+
+%% This is called by the emqx_rule_engine.appup.src when release downgrade
+ensure_api_delegator_stopped() ->
+    case supervisor:terminate_child(?MODULE, emqx_rule_engine_api) of
+        ok ->
+            %% don't crash if delete failed
+            supervisor:delete_child(?MODULE, emqx_rule_engine_api);
+        {error, not_found} -> ok
+    end.
+
+api_delegator_sup_spec() ->
+    #{
+        id => emqx_rule_engine_api,
+        start => {emqx_rule_engine_api, start_link, []},
+        restart => permanent,
+        shutdown => 5000,
+        type => worker,
+        modules => [emqx_rule_engine_api]
+    }.
--- a/changes/v4.4.12-en.md
+++ b/changes/v4.4.12-en.md
@ -17,3 +17,5 @@
 - Fixed EMQX Helm Chart using incorrect secret values when custom credentials are provided [#9508](https://github.com/emqx/emqx/pull/9508).

 - Fixed EMQX Helm Chart can not set JSON type value for EMQX Broker configuration items [#9504](https://github.com/emqx/emqx/pull/9504).
+
+- When resource creation is too slow, there may be some temporary probing connections left [#9539](https://github.com/emqx/emqx/pull/9539).
--- a/changes/v4.4.12-zh.md
+++ b/changes/v4.4.12-zh.md
@ -17,3 +17,5 @@
 - 修复了 EMQX Helm Chart 中当用户使用自定义的用户名和密码时，创建的 Secret 资源不正确问题 [#9508](https://github.com/emqx/emqx/pull/9508)。

 - 修复 EMQX Helm Chart 无法配置 value 为 JSON 类型的 EMQX Broker 配置项 [#9504](https://github.com/emqx/emqx/pull/9504)。
+
+- 当创建资源过慢的情况下，有可能会残留一些用来探活的临时的连接 [#9539](https://github.com/emqx/emqx/pull/9539)。