You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pekko.apache.org by fa...@apache.org on 2026/08/04 17:42:52 UTC
(pekko-management) branch main updated: deduplicate sslcontext code by creating an internal shared util (#910)
This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pekko-management.git
The following commit(s) were added to refs/heads/main by this push:
new 2f4923d4 deduplicate sslcontext code by creating an internal shared util (#910)
2f4923d4 is described below
commit 2f4923d4959846ceb97d2181b481d60efb872dad
Author: PJ Fanning <pj...@users.noreply.github.com>
AuthorDate: Tue Aug 4 18:42:47 2026 +0100
deduplicate sslcontext code by creating an internal shared util (#910)
---
.../kubernetes/KubernetesApiServiceDiscovery.scala | 15 +--------------
.../internal/AbstractKubernetesApiImpl.scala | 19 +++----------------
.../pekko/pki/kubernetes/PemManagersProvider.scala | 22 ++++++++++++++++++++--
.../kubernetes/KubernetesApiImpl.scala | 18 +-----------------
4 files changed, 25 insertions(+), 49 deletions(-)
diff --git a/discovery-kubernetes-api/src/main/scala/org/apache/pekko/discovery/kubernetes/KubernetesApiServiceDiscovery.scala b/discovery-kubernetes-api/src/main/scala/org/apache/pekko/discovery/kubernetes/KubernetesApiServiceDiscovery.scala
index da497358..943af7b5 100644
--- a/discovery-kubernetes-api/src/main/scala/org/apache/pekko/discovery/kubernetes/KubernetesApiServiceDiscovery.scala
+++ b/discovery-kubernetes-api/src/main/scala/org/apache/pekko/discovery/kubernetes/KubernetesApiServiceDiscovery.scala
@@ -16,8 +16,6 @@ package org.apache.pekko.discovery.kubernetes
import java.net.InetAddress
import java.nio.charset.StandardCharsets
import java.nio.file.{ Files, Paths }
-import java.security.{ KeyStore, SecureRandom }
-import javax.net.ssl.{ KeyManager, KeyManagerFactory, SSLContext, TrustManager }
import scala.collection.immutable
import scala.collection.immutable.Seq
@@ -233,18 +231,7 @@ class KubernetesApiServiceDiscovery(settings: Settings)(
* This uses blocking IO, and so should only be used at startup from blocking dispatcher.
*/
private def clientHttpsConnectionContext(): HttpsConnectionContext = {
- val certificates = PemManagersProvider.loadCertificates(settings.apiCaPath)
-
- val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
- val keyStore = KeyStore.getInstance("PKCS12")
- keyStore.load(null)
- factory.init(keyStore, Array.empty)
- val km: Array[KeyManager] = factory.getKeyManagers
- val tm: Array[TrustManager] =
- PemManagersProvider.buildTrustManagers(certificates)
- val random: SecureRandom = new SecureRandom
- val sslContext = SSLContext.getInstance(settings.tlsVersion)
- sslContext.init(km, tm, random)
+ val sslContext = PemManagersProvider.createSslContext(settings.apiCaPath, settings.tlsVersion)
ConnectionContext.httpsClient(sslContext)
}
diff --git a/lease-kubernetes/src/main/scala/org/apache/pekko/coordination/lease/kubernetes/internal/AbstractKubernetesApiImpl.scala b/lease-kubernetes/src/main/scala/org/apache/pekko/coordination/lease/kubernetes/internal/AbstractKubernetesApiImpl.scala
index 50fcbfde..49fb33ab 100644
--- a/lease-kubernetes/src/main/scala/org/apache/pekko/coordination/lease/kubernetes/internal/AbstractKubernetesApiImpl.scala
+++ b/lease-kubernetes/src/main/scala/org/apache/pekko/coordination/lease/kubernetes/internal/AbstractKubernetesApiImpl.scala
@@ -30,8 +30,7 @@ import pekko.stream.scaladsl.{ FileIO, Keep, Sink }
import pekko.util.ByteString
import java.nio.file.{ Files, Paths }
-import java.security.{ KeyStore, SecureRandom }
-import javax.net.ssl.{ KeyManager, KeyManagerFactory, SSLContext, TrustManager }
+import javax.net.ssl.SSLContext
import scala.collection.immutable
import scala.concurrent.{ ExecutionContext, Future }
import scala.util.control.NonFatal
@@ -51,20 +50,8 @@ import scala.util.control.NonFatal
protected val log: LoggingAdapter = Logging(system, getClass: Class[?])
private val http: HttpExt = Http()(system)
- private lazy val sslContext: SSLContext = {
- val certificates = PemManagersProvider.loadCertificates(settings.apiCaPath)
- val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
- val keyStore = KeyStore.getInstance("PKCS12")
- keyStore.load(null)
- factory.init(keyStore, Array.empty)
- val km: Array[KeyManager] = factory.getKeyManagers
- val tm: Array[TrustManager] =
- PemManagersProvider.buildTrustManagers(certificates)
- val random: SecureRandom = new SecureRandom
- val sslContext = SSLContext.getInstance(settings.tlsVersion)
- sslContext.init(km, tm, random)
- sslContext
- }
+ private lazy val sslContext: SSLContext =
+ PemManagersProvider.createSslContext(settings.apiCaPath, settings.tlsVersion)
private lazy val clientSslContext: HttpsConnectionContext = ConnectionContext.httpsClient(sslContext)
diff --git a/management-pki/src/main/scala/org/apache/pekko/pki/kubernetes/PemManagersProvider.scala b/management-pki/src/main/scala/org/apache/pekko/pki/kubernetes/PemManagersProvider.scala
index 5dd24816..a867dacb 100644
--- a/management-pki/src/main/scala/org/apache/pekko/pki/kubernetes/PemManagersProvider.scala
+++ b/management-pki/src/main/scala/org/apache/pekko/pki/kubernetes/PemManagersProvider.scala
@@ -16,7 +16,7 @@ package org.apache.pekko.pki.kubernetes
import java.io.File
import java.nio.charset.StandardCharsets
import java.nio.file.Files
-import java.security.{ KeyStore, PrivateKey }
+import java.security.{ KeyStore, PrivateKey, SecureRandom }
import java.security.cert.{ Certificate, CertificateFactory }
import scala.concurrent.blocking
@@ -27,7 +27,7 @@ import org.apache.pekko
import pekko.annotation.InternalApi
import pekko.pki.pem.{ DERPrivateKeyLoader, PEMDecoder }
-import javax.net.ssl.{ TrustManager, TrustManagerFactory }
+import javax.net.ssl.{ KeyManagerFactory, SSLContext, TrustManager, TrustManagerFactory }
/**
* INTERNAL API
@@ -68,4 +68,22 @@ private[pekko] object PemManagersProvider {
certFactory.generateCertificates(Files.newInputStream(new File(filename).toPath)).asScala
}
+ /**
+ * INTERNAL API
+ *
+ * Creates an SSLContext that trusts the given CA certificate file, with no client key material.
+ */
+ @InternalApi def createSslContext(caCertPath: String, tlsVersion: String): SSLContext = {
+ val certificates = loadCertificates(caCertPath)
+ val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
+ val ks = KeyStore.getInstance("PKCS12")
+ ks.load(null)
+ factory.init(ks, Array.empty)
+ val km = factory.getKeyManagers
+ val tm = buildTrustManagers(certificates)
+ val sslContext = SSLContext.getInstance(tlsVersion)
+ sslContext.init(km, tm, new SecureRandom)
+ sslContext
+ }
+
}
diff --git a/rolling-update-kubernetes/src/main/scala/org/apache/pekko/rollingupdate/kubernetes/KubernetesApiImpl.scala b/rolling-update-kubernetes/src/main/scala/org/apache/pekko/rollingupdate/kubernetes/KubernetesApiImpl.scala
index c91fca20..188f74fd 100644
--- a/rolling-update-kubernetes/src/main/scala/org/apache/pekko/rollingupdate/kubernetes/KubernetesApiImpl.scala
+++ b/rolling-update-kubernetes/src/main/scala/org/apache/pekko/rollingupdate/kubernetes/KubernetesApiImpl.scala
@@ -47,12 +47,6 @@ import pekko.util.ByteString
import java.nio.file.Files
import java.nio.file.Paths
-import java.security.KeyStore
-import java.security.SecureRandom
-import javax.net.ssl.KeyManager
-import javax.net.ssl.KeyManagerFactory
-import javax.net.ssl.SSLContext
-import javax.net.ssl.TrustManager
/**
* INTERNAL API
@@ -473,17 +467,7 @@ PUTs must contain resourceVersions. Response:
*/
private def clientHttpsConnectionContext(k8sSettings: KubernetesSettings): Option[HttpsConnectionContext] = {
if (k8sSettings.secure) {
- val certificates = PemManagersProvider.loadCertificates(k8sSettings.apiCaPath)
- val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
- val keyStore = KeyStore.getInstance("PKCS12")
- keyStore.load(null)
- factory.init(keyStore, Array.empty)
- val km: Array[KeyManager] = factory.getKeyManagers
- val tm: Array[TrustManager] =
- PemManagersProvider.buildTrustManagers(certificates)
- val random: SecureRandom = new SecureRandom
- val sslContext = SSLContext.getInstance("TLSv1.2")
- sslContext.init(km, tm, random)
+ val sslContext = PemManagersProvider.createSslContext(k8sSettings.apiCaPath, "TLSv1.2")
Some(ConnectionContext.httpsClient(sslContext))
} else
None
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pekko.apache.org
For additional commands, e-mail: commits-help@pekko.apache.org