hazelcast / hazelcast/hazelcast-eureka
Separate EurekaClient via EurekaOneDiscoveryStrategy + Custom SSLContext
- Dominant language
- Java
- Stars
- 33
- Forks
- 28
- Avg merge
- 19h 22m
- Merged PRs (30d)
- 7
Description
I'm having a difficult time registering my hazelcast instance when the Eureka Service is using HTTPS / Secure Ports.
I have been able to override the `DiscoveryClient.DiscoveryClientOptionalArgs` settings with my own SSLContext when the main Spring Boot Service registers with Eureka and that works. However, because I am using the `EurekaConfig` of Hazelcast to register a different name via an effective different EurekaClient, I cannot seem to get access to the internals to use the same SSLContext.
I'm really hoping the contributors to this project are able to help me.
This is what I used to do the separate registration without TLS:
pom.xml
```xml
com.hazelcast
hazelcast-eureka-one
1.1.2
```
```java
return new NetworkConfig()
.setJoin(new JoinConfig()
.setMulticastConfig(new MulticastConfig()
.setEnabled(false))
.setEurekaConfig(new EurekaConfig()
.setEnabled(true)
.setProperty("self-registration", eurekaEurekaOneSelfRegistration)
.setProperty("namespace", eurekaEurekaOneNamespace)
.setProperty("name", eurekaEurekaOneName)
.setProperty("shouldUseDns", eurekaEurekaOneShouldUseDns)
.setProperty("serviceUrl.default", eurekaClientServiceUrlDefaultZone)
.setProperty("use-metadata-for-host-and-port", "false")
.setProperty("use-classpath-eureka-client-props", eurekaEurekaOneUseClasspathEurekaClientProps)
));
```
and this works fine when Eureka is accessible via http. However, it cannot find the Self-Signed CA when Eureka is using secure ports and https.
I'm unable to use the system properties `-Djavax.net.ssl.trustStore` and such. Again, when I define my own `DiscoveryClient.DiscoveryClientOptionalArgs` and set the `SSLContext` it only seems to apply to the EurekaClient proper (i.e. the Spring Boot registration, not the hazelcast registration.)
This works for the Sprint Boot Registration itself, but not the hazelcast registration:
```java
@Configuration
@BootstrapConfiguration
public class SslBootstrapConfiguration
{
@Value("${http.client.ssl.trust-store}")
private URL trustStore;
@Value("${http.client.ssl.trust-store-password}")
private String trustStorePassword;
@Bean
public DiscoveryClient.DiscoveryClientOptionalArgs getTrustStoredEurekaClient(SSLContext sslContext) {
DiscoveryClient.DiscoveryClientOptionalArgs args = new DiscoveryClient.DiscoveryClientOptionalArgs();
args.setSSLContext(sslContext);
SSLContext.setDefault(sslContext);
return args;
}
@Bean
public SSLContext sslContext() throws Exception {
return new SSLContextBuilder().loadTrustMaterial(trustStore, trustStorePassword.toCharArray()).build();
}
}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the EurekaConfig setup in the pom.xml example and the separate EurekaClient path described in the issue. Compare it with SslBootstrapConfiguration and DiscoveryClient.DiscoveryClientOptionalArgs to determine where the custom SSLContext is lost. Done means the Hazelcast Eureka registration can use the caller-provided SSLContext for HTTPS and self-signed CA connections.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100