Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WFCORE-6755] Move the org.wildfly.security:wildfly-elytron-dynamic-ssl artifact into its own module #5947

Closed
wants to merge 1 commit into from

Conversation

Skyllarr
Copy link
Contributor

@Skyllarr Skyllarr commented Apr 9, 2024

@github-actions github-actions bot added the deps-ok Dependencies have been checked, and there are no significant changes label Apr 9, 2024
@wildfly-ci
Copy link

Core -> Full Integration Build 13459 outcome was FAILURE using a merge of 7f57b63
Summary: Exit code 1 (Step: Build full with JDK 17 (Maven)) Build time: 00:04:55

@wildfly-ci
Copy link

Core -> WildFly Preview Integration Build 13519 outcome was FAILURE using a merge of 7f57b63
Summary: Exit code 1 (Step: Build & test full (Maven)) Build time: 00:06:37

@wildfly-ci
Copy link

Core -> Full Integration Build 13718 outcome was FAILURE using a merge of 7f57b63
Summary: Exit code 1 (Step: Build full with JDK 17 (Maven)) Build time: 00:07:28

@wildfly-ci

This comment was marked as outdated.

@wildfly-ci

This comment was marked as outdated.

@wildfly-ci

This comment was marked as outdated.

@wildfly-ci

This comment was marked as outdated.

@wildfly-ci

This comment was marked as outdated.

@wildfly-ci

This comment was marked as outdated.

@yersan yersan added the Blocker label Apr 10, 2024
@yersan
Copy link
Collaborator

yersan commented Apr 10, 2024

Hello @Skyllarr , we need a WFLY Jira/PR in place to fix the layers test case in WildFly. We can merge this WFCORE PR as the latest PR for this release, but we need the Jira/PR to run manually the integration Job.

An alternative is to hack the WidlFly LayersTestCase to ignore this specific layer, and then remove the hack once Core is bumped on WildFly

@yersan yersan requested a review from fjuma April 10, 2024 09:59
@wildfly-ci
Copy link

Core -> WildFly Preview Integration Build 13527 outcome was FAILURE using a merge of a218264
Summary: Tests failed: 1, passed: 4975, ignored: 86 Build time: 02:49:56

Failed tests

org.jboss.as.test.layers.expansion.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


@Skyllarr
Copy link
Contributor Author

Hello @Skyllarr , we need a WFLY Jira/PR in place to fix the layers test case in WildFly. We can merge this WFCORE PR as the latest PR for this release, but we need the Jira/PR to run manually the integration Job.

An alternative is to hack the WidlFly LayersTestCase to ignore this specific layer, and then remove the hack once Core is bumped on WildFly

Thanks @yersan , I've created https://issues.redhat.com/browse/WFLY-19223 and I'm working on fixing the test

@yersan
Copy link
Collaborator

yersan commented Apr 11, 2024

@yersan yersan added the 24.x label Apr 11, 2024
@wildfly-ci

This comment was marked as outdated.

@wildfly-ci

This comment was marked as outdated.

Copy link
Collaborator

@yersan yersan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Skyllarr The integration test failed, if we really don't want to provision this module when we are trimming the server, the fix in WildFly Full should be to add it at https://github.com/wildfly/wildfly/blob/a53eba00bde46400befd053c4a104e7107da0071/testsuite/shared/src/main/java/org/jboss/as/test/shared/LayersTestBase.java#L45 instead.

But I have doubts whether this is want we want to do, I would expect this feature also when we are trimming the server but we are including the Elytron layer

@@ -26,6 +26,7 @@ public class LayersTestCase {
// No patching modules in layers
"org.jboss.as.patching",
"org.jboss.as.patching.cli",
"org.wildfly.security.elytron-dynamic-ssl"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the intention is to leave the usage of this module when the server is trimmed including the Elytron layer, this change could be fine but we need to add a comment above it explaining the reason why this module is not provided when using layers.

I have doubts we want that, it looks like the intention could be to also provide the capabilities of the dynamic SSL context even when we are using the Elytron layer. If that's the case, I guess you have to register the module with

default void registerAdditionalRuntimePackages(final ManagementResourceRegistration resourceRegistration) {
, which in turns should be invoked depending on the current Stability level

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be invoked depending on the current Stability level

or as a different way to see it, be invoked when the management resource associated with this Elytron Dynamic SSL is being registered, which I would assume is registered for community only stability level

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yersan yes, this module should be provided when using elytron layer and the community stability. I'll fix this, thank you!

@wildfly-ci

This comment was marked as outdated.

@Skyllarr
Copy link
Contributor Author

@yersan I've addressed your feedback. I closed the affiliated wildfly PR since these latest changes do not introduce a failure in wildfly testsuite. Thank you!

@Skyllarr
Copy link
Contributor Author

@darranl / @fjuma Please review, thanks!

@Skyllarr Skyllarr requested a review from darranl April 11, 2024 17:12
@wildfly-ci
Copy link

Core -> Full Integration Build 13495 outcome was UNKNOWN using a merge of f56300e
Summary: Canceled (Swabra) Build time: 02:31:31

@wildfly-ci
Copy link

Core -> WildFly Preview Integration Build 13556 outcome was FAILURE using a merge of f56300e
Summary: Tests failed: 1, passed: 4977, ignored: 86 Build time: 03:35:09

Failed tests

org.jboss.as.test.layers.expansion.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


@wildfly-ci
Copy link

Core -> Full Integration Build 13757 outcome was UNKNOWN using a merge of f56300e
Summary: Canceled (Step 2/7) Build time: 04:21:51

@wildfly-ci

This comment was marked as outdated.

@Skyllarr Skyllarr force-pushed the WFCORE-6755 branch 2 times, most recently from bf0a659 to 7bf0715 Compare April 17, 2024 08:19
@yersan yersan removed the 24.x label Apr 17, 2024
@wildfly-ci
Copy link

Core -> Full Integration Build 13497 outcome was UNKNOWN using a merge of 7bf0715
Summary: Canceled (Exit code 143 (Step: Build full with JDK 17 (Maven)) (new)) Build time: 00:07:22

@wildfly-ci
Copy link

Core -> Full Integration Build 13498 outcome was FAILURE using a merge of 7bf0715
Summary: Tests failed: 2, passed: 4039, ignored: 51 Build time: 02:40:00

Failed tests

org.jboss.as.test.layers.base.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at org.jboss.as.test.layers.base.LayersTestCase.testLayersModuleUse(LayersTestCase.java:37)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


org.jboss.as.test.layers.expansion.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


@wildfly-ci
Copy link

Core -> WildFly Preview Integration Build 13557 outcome was FAILURE using a merge of 7bf0715
Summary: Tests failed: 1, passed: 4976, ignored: 87 Build time: 02:46:59

Failed tests

org.jboss.as.test.layers.expansion.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


@yersan yersan added the 25.x label Apr 22, 2024
Copy link
Collaborator

@yersan yersan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my opinion, this is completed, although we are waiting for https://issues.redhat.com/browse/WFCORE-6805 to do more testing and see if the approach is the correct one. We are waiting to have the ability to limit the available stability levels based on the provisioning stability level

@yersan
Copy link
Collaborator

yersan commented Apr 25, 2024

In my opinion, this is completed, although we are waiting for https://issues.redhat.com/browse/WFCORE-6805 to do more testing and see if the approach is the correct one. We are waiting to have the ability to limit the available stability levels based on the provisioning stability level

Well, current failures on integration tests are not expected, so it still requires investigation into what is causing them.

@Skyllarr
Copy link
Contributor Author

In my opinion, this is completed, although we are waiting for https://issues.redhat.com/browse/WFCORE-6805 to do more testing and see if the approach is the correct one. We are waiting to have the ability to limit the available stability levels based on the provisioning stability level

I see, thanks @yersan ! I will look into the integration tests failures

@wildfly-ci
Copy link

Core -> Full Integration Build 13532 outcome was FAILURE using a merge of af6dd7c
Summary: Tests failed: 2, passed: 3954, ignored: 59 Build time: 02:03:15

Failed tests

org.jboss.as.test.layers.base.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at org.jboss.as.test.layers.base.LayersTestCase.testLayersModuleUse(LayersTestCase.java:37)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


org.jboss.as.test.layers.expansion.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


@wildfly-ci
Copy link

Core -> WildFly Preview Integration Build 13587 outcome was FAILURE using a merge of af6dd7c
Summary: Tests failed: 1, passed: 4994, ignored: 82 Build time: 02:26:13

Failed tests

org.jboss.as.test.layers.expansion.LayersTestCase.testLayersModuleUse: java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
	at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
	at org.jboss.as.test.shared.LayersTestBase.testLayersModuleUse(LayersTestBase.java:409)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)


@Skyllarr
Copy link
Contributor Author

Skyllarr commented May 1, 2024

In my opinion, this is completed, although we are waiting for https://issues.redhat.com/browse/WFCORE-6805 to do more testing and see if the approach is the correct one. We are waiting to have the ability to limit the available stability levels based on the provisioning stability level

Well, current failures on integration tests are not expected, so it still requires investigation into what is causing them.

@yersan This PR should solve the issues with LayersTestCase wildfly/wildfly#17862 , locally it works for me

@yersan
Copy link
Collaborator

yersan commented May 3, 2024

@Skyllarr There is a relevant error on the "Galleon Linux - JDK 11 (Pull Request)" Job:

java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
  at org.junit.Assert.fail(Assert.java:89)
  at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
  at org.jboss.as.test.layers.LayersTestCase.testLayersModuleUse(LayersTestCase.java:111)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.base/java.lang.reflect.Method.invoke(Method.java:566)

I don't know exactly what is causing that, but the problem seems to be that elytron galleon layer is not provisioning the org.wildfly.security.elytron-dynamic-ssl

I've just taken a look but I don't see the root cause, since Elytron subsystem is advertising to Galleon the requirement of this package at https://github.com/wildfly/wildfly-core/pull/5947/files#diff-263be4d2ab5108fc2de76f44766487703d2444e7bcc70bac0aaa4be6a27a9089R114

@jfdenise Could you shed some light on this?

I've just done a quick test and, although the relevant package is correctly advertised with resourceRegistration.registerAdditionalRuntimePackages(RuntimePackageDependency.required(dependencyPackageName)), the expected set of provisioned packages for the Elytron galleon layer does not includes the org.wildfly.security.elytron-dynamic-ssl package name.

What we are missing here?

@yersan
Copy link
Collaborator

yersan commented May 13, 2024

@jfdenise a friendly reminder, do you have any points about why Galleon does not provision the advertised package?

@yersan
Copy link
Collaborator

yersan commented Jun 10, 2024

Hello @jfdenise this is still a blocker for us, could you provide your feedback about why Galleon is not working as we expect for this case? I am not sure if we are missing something here.

@bstansberry
Copy link
Contributor

@Skyllarr There is a relevant error on the "Galleon Linux - JDK 11 (Pull Request)" Job:

java.lang.AssertionError: Some expected modules have not been provisioned in test-all-layers: org.wildfly.security.elytron-dynamic-ssl
  at org.junit.Assert.fail(Assert.java:89)
  at org.jboss.as.test.layers.LayersTest.testLayersModuleUse(LayersTest.java:172)
  at org.jboss.as.test.layers.LayersTestCase.testLayersModuleUse(LayersTestCase.java:111)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.base/java.lang.reflect.Method.invoke(Method.java:566)

I don't know exactly what is causing that, but the problem seems to be that elytron galleon layer is not provisioning the org.wildfly.security.elytron-dynamic-ssl

I've just taken a look but I don't see the root cause, since Elytron subsystem is advertising to Galleon the requirement of this package at https://github.com/wildfly/wildfly-core/pull/5947/files#diff-263be4d2ab5108fc2de76f44766487703d2444e7bcc70bac0aaa4be6a27a9089R114

@jfdenise Could you shed some light on this?

I've just done a quick test and, although the relevant package is correctly advertised with resourceRegistration.registerAdditionalRuntimePackages(RuntimePackageDependency.required(dependencyPackageName)), the expected set of provisioned packages for the Elytron galleon layer does not includes the org.wildfly.security.elytron-dynamic-ssl package name.

What we are missing here?

@yersan Is the resource part of the elytron subsystem configuration provided by the 'elytron' layer? Or, less likely, some other layer included in the test-all-layers set?

I haven't looked at what the 'elytron' layer configures but I suspect it doesn't add this resource.

The resourceRegistration.registerAdditionalRuntimePackages stuff is only relevant if the resource is part of the configuration. It doesn't tell Galleon to provision things that are not in the configuration just in case they user might want to add them later.

If that's the case the solution is to tell LayersTestCase not to expect the module to be provisioned.

@yersan
Copy link
Collaborator

yersan commented Jun 27, 2024

@bstansberry

Is the resource part of the elytron subsystem configuration provided by the 'elytron' layer? Or, less likely, some other layer included in the test-all-layers set?

The resource is just a subresource of the standard Elytron subsystem, however, it is distributed via an optional module, which, in turn, is never provisioned by any other Galleon Layer.

The resourceRegistration.registerAdditionalRuntimePackages stuff is only relevant if the resource is part of the configuration. It doesn't tell Galleon to provision things that are not in the configuration just in case they user might want to add them later.

Ok, thanks for clarifying it. Now I understand the issue is that since not configured by the Elytron subsystem when it is provisioned as a Galleon layer, then the source code will never advertise it requires such a package.

However, this subresource does not require any Elytron subsystem configuration, so, I don't know how it can be added to the Elytron layer as an empty feature.

I can only think of adding it as a required package for the Elytron layer at:

<packages>
<!-- required by default configuration-->
<package name="org.wildfly.extension.elytron.jaas-realm"/>
<package name="org.wildfly.openssl"/>
</packages>

But not sure if that is the correct approach. It fixes the problem, since it makes it provisioned always when Elytron is configured. but not sure if that is the approach or even if we add it there, whether we would still need the resourceRegistration.registerAdditionalRuntimePackages stuff

@darranl
Copy link
Contributor

darranl commented Jul 9, 2024

I think to invert some of the discussions the two times we would expect that this module is NOT provisioned are:

  • provisioning a server that does not contain the elytron extension
  • provisioning a server that only supports default stability level

In all other cases this module should be present in the installation

@yersan
Copy link
Collaborator

yersan commented Jul 10, 2024

Superseded by #6066

@yersan yersan closed this Jul 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
25.x Blocker deps-ok Dependencies have been checked, and there are no significant changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants