Closes gh-51666
* gh-51666:
Polish "Use TLS port for Docker Compose RabbitMQ connection when SSL is configured"
Use TLS port for Docker Compose RabbitMQ connection when SSL is configured
When a rabbitmq Docker Compose service has SSL bundle labels,
RabbitDockerComposeConnectionDetailsFactory created an SslBundle but
still resolved the address from container port 5672, the plain AMQP
listener. As the connection factory enables SSL when an SslBundle is
present, the TLS handshake was attempted against the non-TLS listener
and the connection failed.
The address is now resolved from container port 5671 when an SslBundle
is present, matching RabbitStreamDockerComposeConnectionDetailsFactory
and the Testcontainers-based RabbitContainerConnectionDetailsFactory.
The SSL integration test now opens a connection using the resolved
address and SslBundle so that it fails without this fix.
Signed-off-by: ohchanKyu <okc0202@naver.com>
See gh-51666
The deprecation entry for
management.prometheus.metrics.export.pushgateway.base-url was declared
as "management.promethus", so the deprecation was never reported.
Signed-off-by: ohchanKyu <okc0202@naver.com>
See gh-51627
This commit improves TestImage so that an explicit image can trigger
the creation of the container, with optional additional setup. This
removes the need of creating additional container types for images that
have multiple flavors, and to please the static method that can only
create a container based on a single match.
Closes gh-51082
Prior to this commit, CloudFoundryReactiveActuatorAutoConfiguration
registered a BeanPostProcessor replaced the WebFilterChainProxy bean
with one that handled CF security and delegated to the existing
chain.
Constructing a new WebFilterChainProxy resulted in the loss of any
firewall customization on the existing chain as Spring Security does
not provide an API to retreive the firewall from the existing chain
and apply it to the new chain.
This commit changes the approach and aligns it with its Servlet
counterpart. Instead of post-processing the filter chain proxy, a new
SecurityWebFilterChain that handles cloudfoundryapplication/**
is defined. This chain becomes part of the existing
WebFilterChainProxy, preserving any firewall customization.
Signed-off-by: aashikantkumar <aashikantkumar2@gmail.com>
See gh-51549
Previously, the CloudFoundryAuthorizationExceptions thrown for a
missing application ID or cloud controller URL were not routed
through the error handling that turned them into a SecurityResponse
with a 503 status code. As a result, they were processed by the
general exception handling which resulted in a 500 response.
This commit updates the reactive SecurityInterceptor so that the
exceptions are processed through
SecurityInterceptor::getErrorResponse. This aligns the behavior of
the Cloud Foundry security intergration in a reactive application
more closely with that of a Servlet application.
Fixes gh-51613
Three Assert messages named a parameter that does not exist on the
method. In each case the correct name is already used by neighbouring
code in the same class.
Signed-off-by: kdomo <dongho5088@naver.com>
See gh-51568
Docker records an environment variable that is declared without a value
as a bare name, which DockerEnv maps to a null value rather than
omitting the key. Map.getOrDefault only falls back when the key is
absent, so both the fallback key and the guest default were skipped.
See gh-51546
Signed-off-by: JaeHyunAn <98042706+yyuneu@users.noreply.github.com>
AbstractClientHttpRequestFactoryBuilder.mergedCustomizers and its
reactive counterpart asserted on the customizers field rather than
the customizer parameter. The field is never null since the
constructor defaults it to an empty list, so the assertion always
passed and a null customizer was not rejected.
See gh-51509
Signed-off-by: kdomo <dongho5088@naver.com>
Applying an SSL bundle to a Tomcat server replaced any `SSLHostConfig`
already registered on the connector for a host name, so an
`SSLHostConfig` could not be configured before Spring Boot applied a
bundle to it.
Reuse any existing `SSLHostConfig` during initial configuration, so an
`SSLHostConfig` registered on the connector before the bundle is
applied retains settings such as `trustManagerClassName`,
`truststoreProvider`, or `truststoreAlgorithm`.
Client authentication settings are only applied when creating a new
`SSLHostConfig`, so the `certificateVerification` of an existing
`SSLHostConfig` is retained rather than being overwritten with the
value derived from the `server.ssl.client-auth` property.
See gh-51466
Signed-off-by: Scott Frederick <scottyfred@gmail.com>
Tomcat's SSL configuration is applied to an `SSLHostConfig` for each
host name. When an SSL bundle was updated, a new `SSLHostConfig` was
created and used to replace the existing one for that host name,
discarding any customizations that had been applied to it (for example
by a `TomcatConnectorCustomizer`).
Reuse the existing `SSLHostConfig` for the host name when one is
present, applying the updated bundle to it rather than replacing it. The
existing `SSLHostConfigCertificate` is also reused, as adding a second
certificate with an undefined type to an `SSLHostConfig` is rejected by
Tomcat.
See gh-51290
Signed-off-by: Scott Frederick <scottyfred@gmail.com>
The javadoc promises an IllegalArgumentException, but the method asserts
with Assert.state, which throws an IllegalStateException.
See gh-51175
Signed-off-by: wantaek <wantaekchoi@gmail.com>
Track meter registries added to Metrics.globalRegistry and remove them
on context close.
Disable use of the global registry in tests by default to avoid pinning
cached test contexts.
See gh-50886
Signed-off-by: LordKay-sudo <lkandiro@gmail.com>
The manual metadata entry declares java.lang.Boolean while its
description and default value ("http://localhost") describe a URL
string, and MockMvcWebClientAutoConfiguration and
MockMvcWebDriverAutoConfiguration read the property as a string.
See gh-51110
Signed-off-by: wantaek <wantaekchoi@gmail.com>
This commit adapts @Nullable when calling Map#remove as it correctly
handles nullability.
See gh-50972
Signed-off-by: Manu Sridharan <msridhar@gmail.com>
This commit preserves the classpath-relative path for Flyway migration
discovered by the native image resource provider so nested migrations
remain readable.
See gh-50433
Signed-off-by: Dongliang Xie <dragonfsky@gmail.com>
Tran Ngoc Nhan
Andy Wilkinson
ohchanKyu
Stéphane Nicoll
JaeHyunAn
aashikantkumar
Hyunwoo Jung
Fabio Grassi
Manu Sridharan
Vladimir Sitnikov
kdomo
piyushrajyadav
Scott Frederick
2heunxun
Phillip Webb
wantaek
vvzvvv
Moritz Halbritter
LordKay-sudo
Dongliang Xie
Dmitry Sulman