Fix TLS configuration for WebClient Eureka transport

.github/dependabot.yml

@@ -31,3 +31,29 @@ updates:
     directory: /docs
     schedule:
       interval: weekly
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "5.0.x"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - ".github/workflows/release-train-test.yml"
+      - ".github/workflows/release-train-build.yml"
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: daily
+    target-branch: 5.0.x
+    ignore:
+      # glob 7.2.3+ conflicts with jshint (minimatch) in wro4j-maven-plugin
+      - dependency-name: "org.webjars.npm:glob"
+      # only upgrade patch versions for maintenance branch
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+  - package-ecosystem: npm
+    target-branch: 5.0.x
+    directory: /docs
+    schedule:
+      interval: weekly

.github/workflows/ci.yaml

@@ -1,20 +1,24 @@
 name: Spring Cloud Netflix CI Job
+
 on:
   push:
     branches:
-      - 5.0.x
+      - main
       - 4.3.x
+
   # Scheduled builds run daily at midnight UTC
   schedule:
     - cron: '0 0 * * *'
+
   # Manual trigger with optional branch override
   workflow_dispatch:
     inputs:
       branches:
         description: "Which branch should be built (can be a comma-separated list of branches)"
         required: true
-        default: '5.0.x'
+        default: 'main'
         type: string
+
 jobs:
   deploy:
     uses: spring-cloud/spring-cloud-github-actions/.github/workflows/deploy.yml@b6a6b1963b8762420526591c3d363bd7d09e7d4b # v1.1.1

.github/workflows/deploy-docs.yml

@@ -5,21 +5,24 @@
 # there and re-run the rollout, otherwise your change will be overwritten.
 
 name: Deploy Docs
+
 on:
   push:
     # Allow-list of exactly this branch. A topic or Dependabot branch cut from
     # it carries this file too, and without this filter every push to one of
     # those would dispatch a full docs build for a ref that is not in the
     # Antora playbook.
     branches:
-      - 5.0.x
+      - main
     tags: '**'
   repository_dispatch:
     types: request-build-reference # legacy
   workflow_dispatch:
+
 permissions:
-  contents: read # required to check out private commercial repositories
-  actions: write # required to dispatch the docs build
+  contents: read   # required to check out private commercial repositories
+  actions: write   # required to dispatch the docs build
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -29,13 +32,15 @@ jobs:
         with:
           ref: docs-build
           fetch-depth: 1
+
       # A branch push rebuilds just that branch's docs; a tag push rebuilds
       # everything so the new version appears in the version dropdown.
       - name: Dispatch (partial build)
         if: github.ref_type == 'branch'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
+
       - name: Dispatch (full build)
         if: github.ref_type == 'tag'
         env:

.github/workflows/pr.yml

@@ -1,7 +1,9 @@
 name: PR
+
 on:
   pull_request:
-    branches: [5.0.x, 4.3.x]
+    branches: [ main, 4.3.x ]
+
 jobs:
   build:
     uses: spring-cloud/spring-cloud-github-actions/.github/workflows/pr.yml@b6a6b1963b8762420526591c3d363bd7d09e7d4b # v1.1.1

docs/pom.xml

@@ -8,7 +8,7 @@
 	<parent>
 		<groupId>org.springframework.cloud</groupId>
 		<artifactId>spring-cloud-netflix</artifactId>
-		<version>5.0.3-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 		<relativePath>..</relativePath>
 	</parent>
 	<packaging>jar</packaging>

pom.xml

@@ -3,15 +3,15 @@
 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>spring-cloud-netflix</artifactId>
-	<version>5.0.3-SNAPSHOT</version>
+	<version>5.1.0-SNAPSHOT</version>
 	<packaging>pom</packaging>
 	<name>Spring Cloud Netflix</name>
 	<description>Spring Cloud Netflix</description>
 	<url>https://github.com/spring-cloud/spring-cloud-netflix</url>
 	<parent>
 		<groupId>org.springframework.cloud</groupId>
 		<artifactId>spring-cloud-build</artifactId>
-		<version>5.0.4-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 		<relativePath />
 	</parent>
 	<scm>
@@ -80,8 +80,8 @@
 	</developers>
 	<properties>
 		<bintray.package>netflix</bintray.package>
-		<spring-cloud-commons.version>5.0.4-SNAPSHOT</spring-cloud-commons.version>
-		<spring-cloud-config.version>5.0.6-SNAPSHOT</spring-cloud-config.version>
+		<spring-cloud-commons.version>5.1.0-SNAPSHOT</spring-cloud-commons.version>
+		<spring-cloud-config.version>5.1.0-SNAPSHOT</spring-cloud-config.version>
 		<testcontainers.version>1.21.4</testcontainers.version>
 		<mockserverclient.version>5.15.0</mockserverclient.version>
 

spring-cloud-netflix-dependencies/pom.xml

@@ -5,11 +5,11 @@
 	<parent>
 		<artifactId>spring-cloud-dependencies-parent</artifactId>
 		<groupId>org.springframework.cloud</groupId>
-		<version>5.0.4-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 		<relativePath/>
 	</parent>
 	<artifactId>spring-cloud-netflix-dependencies</artifactId>
-	<version>5.0.3-SNAPSHOT</version>
+	<version>5.1.0-SNAPSHOT</version>
 	<packaging>pom</packaging>
 	<name>spring-cloud-netflix-dependencies</name>
 	<description>Spring Cloud Netflix Dependencies</description>

spring-cloud-netflix-eureka-client-tls-tests/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.cloud</groupId>
 		<artifactId>spring-cloud-netflix</artifactId>
-		<version>5.0.3-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 		<relativePath>..</relativePath> <!-- lookup parent from repository -->
 	</parent>
 	<artifactId>spring-cloud-netflix-eureka-client-tls-tests</artifactId>
@@ -48,6 +48,10 @@
 			<groupId>org.springframework</groupId>
 			<artifactId>spring-web</artifactId>
 		</dependency>
+                <dependency>
+                        <groupId>org.springframework.boot</groupId>
+                        <artifactId>spring-boot-starter-webflux</artifactId>
+                </dependency>
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-annotations</artifactId>

spring-cloud-netflix-eureka-client-tls-tests/src/test/java/org/springframework/cloud/netflix/eureka/EurekaClientSuite.java

@@ -26,7 +26,7 @@
  * That means that when the new context starts we will fail cause the executor service is
  * already shutdown.
  */
-@SelectClasses({ EurekaClientTests.class, RestClientEurekaClientTests.class })
+@SelectClasses({ EurekaClientTests.class, RestClientEurekaClientTests.class, WebClientEurekaClientTests.class })
 @Suite
 public class EurekaClientSuite {
 

spring-cloud-netflix-eureka-client-tls-tests/src/test/java/org/springframework/cloud/netflix/eureka/WebClientEurekaClientTests.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2018-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.cloud.netflix.eureka;
+
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+
+import org.springframework.boot.SpringBootConfiguration;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.cloud.configuration.TlsProperties;
+import org.springframework.cloud.netflix.eureka.http.WebClientDiscoveryClientOptionalArgs;
+import org.springframework.cloud.netflix.eureka.http.WebClientTransportClientFactories;
+import org.springframework.cloud.netflix.eureka.server.EnableEurekaServer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.web.reactive.function.client.WebClient;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.springframework.cloud.netflix.eureka.config.DiscoveryClientOptionalArgsConfiguration.setupTLS;
+
+/**
+ * Tests for verifying TLS setup with {@link WebClientTransportClientFactories}.
+ *
+ * @author Olga Maciaszek-Sharma
+ */
+public class WebClientEurekaClientTests extends BaseCertTests {
+
+	private static final Log LOG = LogFactory.getLog(WebClientEurekaClientTests.class);
+
+	private static EurekaServerRunner server;
+
+	private static EurekaClientRunner service;
+
+	@BeforeAll
+	public static void setupAll() {
+		server = startEurekaServer(TestEurekaServer.class);
+		service = startService(server, TestApp.class);
+		assertThat(service.discoveryClientOptionalArgs()).isInstanceOf(WebClientDiscoveryClientOptionalArgs.class);
+		LOG.info("Successfully asserted that WebClient will be used");
+		waitForRegistration(() -> new WebClientEurekaClientTests().createEurekaClient());
+	}
+
+	@AfterAll
+	public static void tearDownAll() {
+		stopService(service);
+		stopEurekaServer(server);
+	}
+
+	@Override
+	EurekaClientRunner createEurekaClient() {
+		return new EurekaClientRunner(TestApp.class, server);
+	}
+
+	@SpringBootConfiguration
+	@EnableAutoConfiguration
+	public static class TestApp {
+
+		@Bean
+		public WebClientDiscoveryClientOptionalArgs forceWebClientDiscoveryClientOptionalArgs(
+				TlsProperties tlsProperties) throws GeneralSecurityException, IOException {
+			WebClientDiscoveryClientOptionalArgs result = new WebClientDiscoveryClientOptionalArgs(WebClient::builder);
+			setupTLS(result, tlsProperties);
+			return result;
+		}
+
+		@Bean
+		public WebClientTransportClientFactories forceWebClientTransportClientFactories() {
+			return new WebClientTransportClientFactories(WebClient::builder);
+		}
+
+	}
+
+	@SpringBootConfiguration
+	@EnableAutoConfiguration
+	@EnableEurekaServer
+	public static class TestEurekaServer {
+
+	}
+
+}

spring-cloud-netflix-eureka-client/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.cloud</groupId>
 		<artifactId>spring-cloud-netflix</artifactId>
-		<version>5.0.3-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 		<relativePath>..</relativePath> <!-- lookup parent from repository -->
 	</parent>
 	<artifactId>spring-cloud-netflix-eureka-client</artifactId>

spring-cloud-netflix-eureka-client/src/main/java/org/springframework/cloud/netflix/eureka/http/WebClientTransportClientFactories.java

@@ -52,7 +52,7 @@ public TransportClientFactory newTransportClientFactory(EurekaClientConfig clien
 	public TransportClientFactory newTransportClientFactory(final EurekaClientConfig clientConfig,
 			final Collection<Void> additionalFilters, final InstanceInfo myInstanceInfo,
 			final Optional<SSLContext> sslContext, final Optional<HostnameVerifier> hostnameVerifier) {
-		return new WebClientTransportClientFactory(builder);
+		return new WebClientTransportClientFactory(builder, sslContext);
 	}
 
 }

spring-cloud-netflix-eureka-client/src/main/java/org/springframework/cloud/netflix/eureka/http/WebClientTransportClientFactory.java

@@ -16,12 +16,17 @@
 
 package org.springframework.cloud.netflix.eureka.http;
 
+import java.util.Optional;
 import java.util.function.Supplier;
 
+import javax.net.ssl.SSLContext;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.netflix.discovery.shared.resolver.EurekaEndpoint;
 import com.netflix.discovery.shared.transport.EurekaHttpClient;
 import com.netflix.discovery.shared.transport.TransportClientFactory;
+import io.netty.handler.ssl.ClientAuth;
+import io.netty.handler.ssl.JdkSslContext;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.netty.http.client.HttpClient;
@@ -58,12 +63,20 @@ public class WebClientTransportClientFactory implements TransportClientFactory {
 
 	private final Supplier<WebClient.Builder> builderSupplier;
 
+	private final Optional<SSLContext> sslContext;
+
 	private final ConnectionProvider connectionProvider;
 
 	private final LoopResources loopResources;
 
 	public WebClientTransportClientFactory(Supplier<WebClient.Builder> builderSupplier) {
+		this(builderSupplier, Optional.empty());
+	}
+
+	public WebClientTransportClientFactory(Supplier<WebClient.Builder> builderSupplier,
+			Optional<SSLContext> sslContext) {
 		this.builderSupplier = builderSupplier;
+		this.sslContext = sslContext;
 		this.connectionProvider = ConnectionProvider.create("eureka-webclient");
 		this.loopResources = LoopResources.create("eureka-webclient");
 	}
@@ -78,8 +91,14 @@ public EurekaHttpClient newClient(EurekaEndpoint endpoint) {
 		// Use dedicated Reactor Netty resources independent of the reactive web server
 		// to prevent RejectedExecutionException during graceful shutdown when the
 		// server's event loop terminates before DiscoveryClient deregisters.
-		builder.clientConnector(
-				new ReactorClientHttpConnector(HttpClient.create(this.connectionProvider).runOn(this.loopResources)));
+		HttpClient httpClient = HttpClient.create(this.connectionProvider).runOn(this.loopResources);
+
+		if (this.sslContext.isPresent()) {
+			httpClient = httpClient.secure(sslContextSpec -> sslContextSpec
+				.sslContext(new JdkSslContext(this.sslContext.get(), true, ClientAuth.NONE)));
+		}
+
+		builder.clientConnector(new ReactorClientHttpConnector(httpClient));
 		return new WebClientEurekaHttpClient(builder.build());
 	}
 

spring-cloud-netflix-eureka-server/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.cloud</groupId>
 		<artifactId>spring-cloud-netflix</artifactId>
-		<version>5.0.3-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 		<relativePath>..</relativePath> <!-- lookup parent from repository -->
 	</parent>
 	<artifactId>spring-cloud-netflix-eureka-server</artifactId>

spring-cloud-starter-netflix-eureka-client/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>org.springframework.cloud</groupId>
 		<artifactId>spring-cloud-netflix</artifactId>
-		<version>5.0.3-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 	</parent>
 	<artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
 	<name>Spring Cloud Starter Netflix Eureka Client</name>

spring-cloud-starter-netflix-eureka-server/pom.xml

@@ -3,7 +3,7 @@
 	<parent>
 		<groupId>org.springframework.cloud</groupId>
 		<artifactId>spring-cloud-netflix</artifactId>
-		<version>5.0.3-SNAPSHOT</version>
+		<version>5.1.0-SNAPSHOT</version>
 	</parent>
 	<artifactId>spring-cloud-starter-netflix-eureka-server</artifactId>
 	<name>Spring Cloud Starter Netflix Eureka Server</name>