Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add SSL support to Docker Compose and Testcontainers infrastructure

Browse Source 
See gh-41137

Co-authored-by: Phillip Webb <phil.webb@broadcom.com>
This commit is contained in:
Moritz Halbritter
2025-02-11 10:15:58 +01:00
parent 528b7e9ad9
commit b62a0c1ae0
20 changed files with 776 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-boot-project/spring-boot-docker-compose/src/main/java/org/springframework/boot/docker/compose/core/DefaultRunningService.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2023 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -45,6 +45,8 @@ class DefaultRunningService implements RunningService, OriginProvider {
private final DockerEnv env;
private final DockerComposeFile composeFile;
DefaultRunningService(DockerHost host, DockerComposeFile composeFile, DockerCliComposePsResponse composePsResponse,
DockerCliInspectResponse inspectResponse) {
this.origin = new DockerComposeOrigin(composeFile, composePsResponse.name());
@@ -55,6 +57,7 @@ class DefaultRunningService implements RunningService, OriginProvider {
this.ports = new DefaultConnectionPorts(inspectResponse);
this.env = new DockerEnv(inspectResponse.config().env());
this.labels = Collections.unmodifiableMap(inspectResponse.config().labels());
this.composeFile = composeFile;
}
@Override
@@ -97,4 +100,9 @@ class DefaultRunningService implements RunningService, OriginProvider {
return this.name;
}
@Override
public DockerComposeFile composeFile() {
return this.composeFile;
}
}

11
spring-boot-project/spring-boot-docker-compose/src/main/java/org/springframework/boot/docker/compose/core/RunningService.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2024 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -64,4 +64,13 @@ public interface RunningService {
*/
Map<String, String> labels();
/**
* Return the Docker Compose file for the service.
* @return the Docker Compose file
* @since 3.5.0
*/
default DockerComposeFile composeFile() {
return null;
}
}

125
spring-boot-project/spring-boot-docker-compose/src/main/java/org/springframework/boot/docker/compose/service/connection/DockerComposeConnectionDetailsFactory.java
View File

@@ -16,17 +16,33 @@
package org.springframework.boot.docker.compose.service.connection;
import java.nio.file.Path;
import java.util.Arrays;
import java.util.Set;
import java.util.function.Predicate;
import org.springframework.boot.autoconfigure.service.connection.ConnectionDetails;
import org.springframework.boot.autoconfigure.service.connection.ConnectionDetailsFactory;
import org.springframework.boot.docker.compose.core.DockerComposeFile;
import org.springframework.boot.docker.compose.core.RunningService;
import org.springframework.boot.io.ApplicationResourceLoader;
import org.springframework.boot.origin.Origin;
import org.springframework.boot.origin.OriginProvider;
import org.springframework.boot.ssl.SslBundle;
import org.springframework.boot.ssl.SslBundleKey;
import org.springframework.boot.ssl.SslOptions;
import org.springframework.boot.ssl.jks.JksSslStoreBundle;
import org.springframework.boot.ssl.jks.JksSslStoreDetails;
import org.springframework.boot.ssl.pem.PemSslStore;
import org.springframework.boot.ssl.pem.PemSslStoreBundle;
import org.springframework.boot.ssl.pem.PemSslStoreDetails;
import org.springframework.core.io.ResourceLoader;
import org.springframework.core.io.support.SpringFactoriesLoader;
import org.springframework.util.Assert;
import org.springframework.util.ClassUtils;
import org.springframework.util.CollectionUtils;
import org.springframework.util.ObjectUtils;
import org.springframework.util.StringUtils;
/**
* Base class for {@link ConnectionDetailsFactory} implementations that provide
@@ -106,6 +122,8 @@ public abstract class DockerComposeConnectionDetailsFactory<D extends Connection
private final Origin origin;
private volatile SslBundle sslBundle;
/**
* Create a new {@link DockerComposeConnectionDetails} instance.
* @param runningService the source {@link RunningService}
@@ -120,6 +138,113 @@ public abstract class DockerComposeConnectionDetailsFactory<D extends Connection
return this.origin;
}
protected SslBundle getSslBundle(RunningService service) {
if (this.sslBundle != null) {
return this.sslBundle;
}
SslBundle jksSslBundle = getJksSslBundle(service);
SslBundle pemSslBundle = getPemSslBundle(service);
if (jksSslBundle == null && pemSslBundle == null) {
return null;
}
if (jksSslBundle != null && pemSslBundle != null) {
throw new IllegalStateException("Mutually exclusive JKS and PEM ssl bundles have been configured");
}
SslBundle sslBundle = (jksSslBundle != null) ? jksSslBundle : pemSslBundle;
this.sslBundle = sslBundle;
return sslBundle;
}
private SslBundle getJksSslBundle(RunningService service) {
JksSslStoreDetails keyStoreDetails = getJksSslStoreDetails(service, "keystore");
JksSslStoreDetails trustStoreDetails = getJksSslStoreDetails(service, "truststore");
if (keyStoreDetails == null && trustStoreDetails == null) {
return null;
}
SslBundleKey key = SslBundleKey.of(service.labels().get("org.springframework.boot.sslbundle.jks.key.alias"),
service.labels().get("org.springframework.boot.sslbundle.jks.key.password"));
SslOptions options = createSslOptions(
service.labels().get("org.springframework.boot.sslbundle.jks.options.ciphers"),
service.labels().get("org.springframework.boot.sslbundle.jks.options.enabled-protocols"));
String protocol = service.labels().get("org.springframework.boot.sslbundle.jks.protocol");
Path workingDirectory = getWorkingDirectory(service);
return SslBundle.of(
new JksSslStoreBundle(keyStoreDetails, trustStoreDetails, getResourceLoader(workingDirectory)), key,
options, protocol);
}
private ResourceLoader getResourceLoader(Path workingDirectory) {
ClassLoader classLoader = ApplicationResourceLoader.get().getClassLoader();
return ApplicationResourceLoader.get(classLoader,
SpringFactoriesLoader.forDefaultResourceLocation(classLoader), workingDirectory);
}
private JksSslStoreDetails getJksSslStoreDetails(RunningService service, String storeType) {
String type = service.labels().get("org.springframework.boot.sslbundle.jks.%s.type".formatted(storeType));
String provider = service.labels()
.get("org.springframework.boot.sslbundle.jks.%s.provider".formatted(storeType));
String location = service.labels()
.get("org.springframework.boot.sslbundle.jks.%s.location".formatted(storeType));
String password = service.labels()
.get("org.springframework.boot.sslbundle.jks.%s.password".formatted(storeType));
if (location == null) {
return null;
}
return new JksSslStoreDetails(type, provider, location, password);
}
private Path getWorkingDirectory(RunningService runningService) {
DockerComposeFile composeFile = runningService.composeFile();
if (composeFile == null || CollectionUtils.isEmpty(composeFile.getFiles())) {
return Path.of(".");
}
return composeFile.getFiles().get(0).toPath().getParent();
}
private SslOptions createSslOptions(String ciphers, String enabledProtocols) {
Set<String> ciphersSet = null;
if (StringUtils.hasLength(ciphers)) {
ciphersSet = StringUtils.commaDelimitedListToSet(ciphers);
}
Set<String> enabledProtocolsSet = null;
if (StringUtils.hasLength(enabledProtocols)) {
enabledProtocolsSet = StringUtils.commaDelimitedListToSet(enabledProtocols);
}
return SslOptions.of(ciphersSet, enabledProtocolsSet);
}
private SslBundle getPemSslBundle(RunningService service) {
PemSslStoreDetails keyStoreDetails = getPemSslStoreDetails(service, "keystore");
PemSslStoreDetails trustStoreDetails = getPemSslStoreDetails(service, "truststore");
if (keyStoreDetails == null && trustStoreDetails == null) {
return null;
}
SslBundleKey key = SslBundleKey.of(service.labels().get("org.springframework.boot.sslbundle.pem.key.alias"),
service.labels().get("org.springframework.boot.sslbundle.pem.key.password"));
SslOptions options = createSslOptions(
service.labels().get("org.springframework.boot.sslbundle.pem.options.ciphers"),
service.labels().get("org.springframework.boot.sslbundle.pem.options.enabled-protocols"));
String protocol = service.labels().get("org.springframework.boot.sslbundle.pem.protocol");
Path workingDirectory = getWorkingDirectory(service);
ResourceLoader resourceLoader = getResourceLoader(workingDirectory);
return SslBundle.of(new PemSslStoreBundle(PemSslStore.load(keyStoreDetails, resourceLoader),
PemSslStore.load(trustStoreDetails, resourceLoader)), key, options, protocol);
}
private PemSslStoreDetails getPemSslStoreDetails(RunningService service, String storeType) {
String type = service.labels().get("org.springframework.boot.sslbundle.pem.%s.type".formatted(storeType));
String certificate = service.labels()
.get("org.springframework.boot.sslbundle.pem.%s.certificate".formatted(storeType));
String privateKey = service.labels()
.get("org.springframework.boot.sslbundle.pem.%s.private-key".formatted(storeType));
String privateKeyPassword = service.labels()
.get("org.springframework.boot.sslbundle.pem.%s.private-key-password".formatted(storeType));
if (certificate == null && privateKey == null) {
return null;
}
return new PemSslStoreDetails(type, certificate, privateKey, privateKeyPassword);
}
}
}