Closes gh-51666
* gh-51666:
Polish "Use TLS port for Docker Compose RabbitMQ connection when SSL is configured"
Use TLS port for Docker Compose RabbitMQ connection when SSL is configured
When a rabbitmq Docker Compose service has SSL bundle labels,
RabbitDockerComposeConnectionDetailsFactory created an SslBundle but
still resolved the address from container port 5672, the plain AMQP
listener. As the connection factory enables SSL when an SslBundle is
present, the TLS handshake was attempted against the non-TLS listener
and the connection failed.
The address is now resolved from container port 5671 when an SslBundle
is present, matching RabbitStreamDockerComposeConnectionDetailsFactory
and the Testcontainers-based RabbitContainerConnectionDetailsFactory.
The SSL integration test now opens a connection using the resolved
address and SslBundle so that it fails without this fix.
Signed-off-by: ohchanKyu <okc0202@naver.com>
See gh-51666
With OpenTelemetry, fields listed in management.tracing.baggage.tag-fields
only became span tags when the application itself touched the baggage
through the Tracer API. Baggage that arrived with a request was
propagated correctly, but spans were not tagged with it (see
micrometer-metrics/tracing#933).
This commit registers Micrometer Tracing's BaggageTaggingSpanProcessor
whenever baggage is enabled and at least one tag field is configured, so
that spans are tagged with the baggage that is present in their parent
context. A custom BaggageTaggingSpanProcessor bean backs off the
auto-configured one. The tag-fields property is now also mentioned in
the baggage section of the tracing documentation.
See gh-51656
Signed-off-by: Oleksandr Shevchenko <oleksandr.shevchenko@datarobot.com>
The deprecation entry for
management.prometheus.metrics.export.pushgateway.base-url was declared
as "management.promethus", so the deprecation was never reported.
Signed-off-by: ohchanKyu <okc0202@naver.com>
See gh-51627
This commit improves TestImage so that an explicit image can trigger
the creation of the container, with optional additional setup. This
removes the need of creating additional container types for images that
have multiple flavors, and to please the static method that can only
create a container based on a single match.
Closes gh-51082
Prior to this commit, CloudFoundryReactiveActuatorAutoConfiguration
registered a BeanPostProcessor replaced the WebFilterChainProxy bean
with one that handled CF security and delegated to the existing
chain.
Constructing a new WebFilterChainProxy resulted in the loss of any
firewall customization on the existing chain as Spring Security does
not provide an API to retreive the firewall from the existing chain
and apply it to the new chain.
This commit changes the approach and aligns it with its Servlet
counterpart. Instead of post-processing the filter chain proxy, a new
SecurityWebFilterChain that handles cloudfoundryapplication/**
is defined. This chain becomes part of the existing
WebFilterChainProxy, preserving any firewall customization.
Signed-off-by: aashikantkumar <aashikantkumar2@gmail.com>
See gh-51549
Previously, the CloudFoundryAuthorizationExceptions thrown for a
missing application ID or cloud controller URL were not routed
through the error handling that turned them into a SecurityResponse
with a 503 status code. As a result, they were processed by the
general exception handling which resulted in a 500 response.
This commit updates the reactive SecurityInterceptor so that the
exceptions are processed through
SecurityInterceptor::getErrorResponse. This aligns the behavior of
the Cloud Foundry security intergration in a reactive application
more closely with that of a Servlet application.
Fixes gh-51613
Spring Boot unconditionally set useRelativeRedirects on the Tomcat
Context, defaulting it to false. That overrode Tomcat's own default and
forced absolute Location headers on every sendRedirect.
Keep server.tomcat.use-relative-redirects a simple boolean, but default
it to true so that relative Location headers are used out of the box.
The property can still be set to false to opt back into absolute
redirects.
Smoke tests that asserted a port-qualified absolute Location are updated
to the relative form, and the proxy tip in the reference documentation is
qualified since the context root redirect no longer carries a scheme.
Signed-off-by: Tiziano Basile <tiz.basile@gmail.com>
See gh-51173
Previously, the auto-configuration of reactive OAuth 2 resource
server based web security did not back off when a custom
SecurityWebFilterChain was defined. This did not match the
equivalent servlet-based auto-configuration which backs off when
a custom SecurityFilterChain is defined.
This commit updates the reactive auto-configuration to behave in
the same way as the servlet auto-configuration. A new annotation,
@ConditionalOnDefaultReactiveWebSecurity, is introduced. The
existing servlet-specific annotation,
@ConditionalOnDefaultWebSecurity is deprecated and a replacement
named @ConditionalOnDefaultServletWebSecurity is introduced.
Fixes gh-50778
Andy Wilkinson
ohchanKyu
Oleksandr Shevchenko
htjworld
Tran Ngoc Nhan
Stéphane Nicoll
JaeHyunAn
aashikantkumar
Hyunwoo Jung
Tiziano Basile
Fabio Grassi
Manu Sridharan