MartijnVisser opened a new pull request, #28676: URL: https://github.com/apache/flink/pull/28676
## What is the purpose of the change Stabilize `RestClientITCase#testHttpsConnectionWithDefaultCerts`. The test proves that `RestClient` completes a TLS handshake against a public CA-signed endpoint using the default JDK truststore, but it additionally required the response body to be valid JSON. On GitHub Actions, runners share egress IPs and GitHub periodically returns a plain-text `429 Too Many Requests`, failing the test even though the handshake — the thing under test — succeeded (example: master run [28791132983](https://github.com/apache/flink/actions/runs/28791132983), leg "Default (Java 17) / E2E (group 4)"). A `RestClientException` is only produced in `RestClient#readRawResponse` after a full HTTP response has been received, i.e. after a successful handshake; a genuine certificate/trust failure surfaces as an `SSLException` from Netty's `SslHandler` instead. The test now asserts on exactly that distinction. ## Brief change log - On a failed request, assert that the failure chain contains a `RestClientException` (proof an HTTP-layer response arrived, hence the default-truststore handshake completed). - Tolerates 429/403/5xx/non-JSON bodies; still fails on SSL/certificate regressions, and also on connection-level failures (connection refused, DNS, reset) where no handshake occurred. ## Verifying this change This change is a test-only stabilization, verified by running the test (`-Prun-end-to-end-tests`) in three configurations: - Against the regular endpoint (valid TLS, JSON body): passes. - Temporarily pointed at a valid-TLS non-JSON body — the exact `RestClientException` branch a 429 takes: passes (failed before this change). - Temporarily pointed at `https://expired.badssl.com` (genuine certificate failure): fails as expected. ## Does this pull request potentially affect one of the following parts: - Dependencies (does it add or upgrade a dependency): no - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no - The serializers: no - The runtime per-record code paths (performance sensitive): no - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no - The S3 file system connector: no ## Documentation - Does this pull request introduce a new feature? no - If yes, how is the feature documented? not applicable --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (Claude Fable 5) Generated-by: Claude Fable 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
