jamesnetherton commented on code in PR #6091:
URL: https://github.com/apache/camel-quarkus/pull/6091#discussion_r1601633677
##########
integration-tests-support/kafka/pom.xml:
##########
@@ -52,6 +52,14 @@
<groupId>io.quarkus</groupId>
<artifactId>quarkus-junit4-mock</artifactId>
</dependency>
+ <dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-util</artifactId>
Review Comment:
Do we need `camel-util`?
##########
integration-tests-support/kafka/src/main/java/org/apache/camel/quarkus/test/support/kafka/KafkaTestResource.java:
##########
@@ -18,38 +18,96 @@
import java.util.Collections;
import java.util.Map;
+import java.util.function.Function;
+import com.github.dockerjava.api.exception.NotFoundException;
import io.quarkus.test.common.QuarkusTestResourceLifecycleManager;
import io.strimzi.test.container.StrimziKafkaContainer;
+import org.apache.camel.quarkus.test.FipsModeUtil;
import org.eclipse.microprofile.config.ConfigProvider;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import org.testcontainers.containers.ContainerFetchException;
+import org.testcontainers.containers.GenericContainer;
+import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.utility.TestcontainersConfiguration;
public class KafkaTestResource implements QuarkusTestResourceLifecycleManager {
protected static final String KAFKA_IMAGE_NAME =
ConfigProvider.getConfig().getValue("kafka.container.image", String.class);
private static final Logger LOGGER =
LoggerFactory.getLogger(KafkaTestResource.class);
private StrimziKafkaContainer container;
+ private GenericContainer j17container;
@Override
public Map<String, String> start() {
LOGGER.info(TestcontainersConfiguration.getInstance().toString());
try {
- container = new StrimziKafkaContainer(KAFKA_IMAGE_NAME)
- /* Added container startup logging because of
https://github.com/apache/camel-quarkus/issues/2461 */
- .withLogConsumer(frame ->
System.out.print(frame.getUtf8String()))
- .waitForRunning();
-
- container.start();
+ startContainer(KAFKA_IMAGE_NAME, name -> new
StrimziKafkaContainer(name));
return Collections.singletonMap("camel.component.kafka.brokers",
container.getBootstrapServers());
} catch (Exception e) {
throw new RuntimeException(e);
}
}
+ public String start(Function<String, StrimziKafkaContainer>
containerSupplier) {
+ LOGGER.info(TestcontainersConfiguration.getInstance().toString());
+
+ //if FIPS environment is present, custom container using J17 has to
used because:
+ // Password-based encryption support in FIPs mode was implemented in
the Red Hat build of OpenJDK 17 update 4
+ if (FipsModeUtil.isFipsMode()) {
+ //custom image should be cached for the next usages with following
id
+ String customImageName = "camel-quarkus-test-custom-" +
KAFKA_IMAGE_NAME.replaceAll("[\\./]", "-");
+
+ try {
+ //in case that the image is not accessible, fetch exception is
thrown
+ startContainer(customImageName, containerSupplier);
+ } catch (ContainerFetchException e) {
+ if (e.getCause() instanceof NotFoundException) {
+ LOGGER.info("Custom image for kafka (%s) does not exist.
Has to be created.", customImageName);
+
+ //start of the customized container will create the image
+ //it is not possible to customize existing
StrimziKafkaContainer. Testcontainer API doe not allow
+ //to customize the image.
+ // This workaround can be removed once the strimzi
container with openjdk 17 is released.
+ // According to
https://strimzi.io/blog/2023/01/25/running-apache-kafka-on-fips-enabled-kubernetes-cluster/
+ // image should exist
+ j17container = new GenericContainer(
+ new ImageFromDockerfile(customImageName, false)
+ .withDockerfileFromBuilder(builder ->
builder
+
.from("quay.io/strimzi-test-container/test-container:latest-kafka-3.2.1")
+ .env("JAVA_HOME",
"/usr/lib/jvm/jre-17")
+ .env("PATH",
"/usr/lib/jvm/jre-17/bin:$PATH")
Review Comment:
Any idea if there's any open issues with Strimzi to see if they can switch
to JDK 17 in their container images?
If not, we should maybe create one.
##########
integration-tests-support/test-support/src/main/java/org/apache/camel/quarkus/test/FipsModeUtil.java:
##########
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.quarkus.test;
+
+import java.security.Provider;
+import java.security.Security;
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+
+public class FipsModeUtil {
Review Comment:
Should have a private constructor if it's a utility class
##########
integration-tests/kafka-ssl/pom.xml:
##########
@@ -78,6 +78,10 @@
<artifactId>quarkus-junit4-mock</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.camel.quarkus</groupId>
+
<artifactId>camel-quarkus-integration-tests-support-certificate</artifactId>
Review Comment:
Should be `<scope>test</scope>`?
##########
integration-tests-support/certificate/src/main/java/org/apache/camel/quarkus/test/support/certificate/TestCertificateGenerationExtension.java:
##########
@@ -0,0 +1,143 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.quarkus.test.support.certificate;
+
+import java.io.File;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Optional;
+
+import me.escoffier.certs.AliasRequest;
+import me.escoffier.certs.CertificateFiles;
+import me.escoffier.certs.CertificateGenerator;
+import me.escoffier.certs.CertificateRequest;
+import me.escoffier.certs.junit5.Alias;
+import me.escoffier.certs.junit5.Certificate;
+import org.eclipse.microprofile.config.ConfigProvider;
+import org.jboss.logging.Logger;
+import org.junit.jupiter.api.extension.*;
+import org.junit.platform.commons.util.AnnotationUtils;
+import org.testcontainers.DockerClientFactory;
+import org.testcontainers.containers.GenericContainer;
+
+/**
+ * Extension is based on
+ *
https://github.com/cescoffier/certificate-generator/blob/main/certificate-generator-junit5/src/main/java/me/escoffier/certs/junit5/CertificateGenerationExtension.java
+ *
+ * Unfortunately there is no way of extending the original Extension with
functionality of modifying CN and
+ * SubjectAlternativeName
+ * based on docker host (required for usage with external docker host)
+ * Therefore I created a new annotation 'TestCertificates' which would use
this new extension.
+ */
+public class TestCertificateGenerationExtension implements BeforeAllCallback,
ParameterResolver {
+ private static final Logger LOGGER =
Logger.getLogger(TestCertificateGenerationExtension.class);
+
+ public static TestCertificateGenerationExtension
getInstance(ExtensionContext extensionContext) {
+ return extensionContext.getStore(ExtensionContext.Namespace.GLOBAL)
+ .get(TestCertificateGenerationExtension.class,
TestCertificateGenerationExtension.class);
+ }
+
+ List<CertificateFiles> certificateFiles = new ArrayList<>();
+
+ @Override
+ public void beforeAll(ExtensionContext extensionContext) throws Exception {
+
+ extensionContext.getStore(ExtensionContext.Namespace.GLOBAL)
+
.getOrComputeIfAbsent(TestCertificateGenerationExtension.class, c -> this);
+ var maybe =
AnnotationUtils.findAnnotation(extensionContext.getRequiredTestClass(),
TestCertificates.class);
+ if (maybe.isEmpty()) {
+ return;
+ }
+ var annotation = maybe.get();
+
+ //cn and alternativeSubjectName might be different (to reflect docker
host)
+ Optional<String> cn = resolveDockerHost();
+ Optional<String> altSubName = cn.stream().map(h ->
"DNS:%s,IP:%s".formatted(h, h)).findAny();
+
+ for (Certificate certificate : annotation.certificates()) {
+ String baseDir = annotation.baseDir();
+ File file = new File(baseDir);
+ file.mkdirs();
+ CertificateGenerator generator = new
CertificateGenerator(file.toPath(), annotation.replaceIfExists());
+
+ CertificateRequest request = new CertificateRequest()
+ .withName(certificate.name())
+ .withClientCertificate(certificate.client())
+ .withFormats(Arrays.asList(certificate.formats()))
+ .withCN(cn.orElse(certificate.cn()))
+ .withPassword(certificate.password().isEmpty() ? null :
certificate.password())
+ .withDuration(Duration.ofDays(certificate.duration()));
+
+ if (cn.isPresent() && cn.get().equals(certificate.cn())) {
+ LOGGER.debugf("Used CN '%s' instead of '%s' because of docker
host.", cn.get(), certificate.cn());
+ LOGGER.debugf("Added SubjectAlternativeName '%s'.",
altSubName.get());
+ }
+
+ if (altSubName.isPresent()) {
+ request.withSubjectAlternativeName(altSubName.get());
+ }
+
+ for (String san : certificate.subjectAlternativeNames()) {
+ request.withSubjectAlternativeName(san);
+ }
+
+ for (Alias alias : certificate.aliases()) {
+ AliasRequest nested = new AliasRequest()
+ .withCN(alias.cn())
+ .withPassword(alias.password())
+ .withClientCertificate(alias.client());
+ request.withAlias(alias.name(), nested);
+ for (String s : alias.subjectAlternativeNames()) {
+ nested.withSubjectAlternativeName(s);
+ }
+ }
+
+ certificateFiles.addAll(generator.generate(request));
+ }
+ }
+
+ private Optional<String> resolveDockerHost() {
+ String dockerHost =
DockerClientFactory.instance().dockerHostIpAddress();
+ if (!dockerHost.equals("localhost") &&
!dockerHost.equals("127.0.0.1")) {
+ String imageName =
ConfigProvider.getConfig().getValue("eclipse-temurin.container.image",
String.class);
Review Comment:
The stuff that was using `eclipse-temurin.container.image` I assume is not
needed anymore given that the cert generator will take care of what it was
being used for?
So maybe any references to this method can just be replaced with
`DockerClientFactory.instance().dockerHostIpAddress()`?
##########
pom.xml:
##########
@@ -86,6 +86,7 @@
<bcprov-ext-jdk18on.version>1.78</bcprov-ext-jdk18on.version><!--
TODO: Remove this. Required as there is no 1.78.1 version released -->
<brotli.version>0.1.2</brotli.version><!-- @sync
org.apache.httpcomponents.client5:httpclient5-parent:${httpclient5.version}
prop:brotli.version -->
<caffeine.version>3.1.5</caffeine.version><!-- @sync
io.quarkus:quarkus-bom:${quarkus.version}
dep:com.github.ben-manes.caffeine:caffeine -->
+ <certificate.generator.version>0.5.0</certificate.generator.version>
Review Comment:
Nitpick - Can you move this with the other test dependency properties:
https://github.com/apache/camel-quarkus/blob/7eebe0453ff401cc083f838aa247ed285688d800/pom.xml#L171-L180
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
