kie-issues#1914: remove Infinispan persistence related modules and dependencies#2297
Open
porcelli wants to merge 3 commits intoapache:mainfrom
Open
kie-issues#1914: remove Infinispan persistence related modules and dependencies#2297porcelli wants to merge 3 commits intoapache:mainfrom
porcelli wants to merge 3 commits intoapache:mainfrom
Conversation
porcelli
requested review from
RishiRajAnand,
Copilot,
fjtirado,
martinweiler and
pefernan
fjtirado
reviewed
Jan 13, 2026
...t-utils/src/main/java/org/kie/kogito/index/test/containers/DataIndexInfinispanContainer.java
Outdated
Show resolved
Hide resolved
fjtirado
reviewed
Jan 13, 2026
fjtirado
approved these changes
Jan 13, 2026
Contributor
|
Hey @porcelli sorry for the late review! I'm +1 on this PR but I see there are a lot of reds in the CI I saw this error: which makes me think that the actual pr still has a reference to Also there are some problems in the RAT exclusions. |
…re jitexecutor-native Delete empty Infinispan-related test files that were missed in the initial removal, causing Apache RAT license header checks to fail: - DataIndexInfinispanContainer.java - DataIndexInfinispanHttpQuarkusTestResource.java - DataIndexInfinispanHttpResource.java - DataIndexInfinispanKafkaResource.java - DataIndexInfinispanQuarkusKafkaTestResource.java Restore jitexecutor-native module that was incorrectly removed (not related to Infinispan persistence).
porcelli
force-pushed
the
updated-ispn-removal
branch
from
ade14aa to
dc71041
Compare
Member
Author
|
@pefernan did a new push, tomorrow I'll check back. sorry for taking longer |
Update README files to reflect the removal of Infinispan persistence: - data-index: remove infinispan from supported storage list - persistence-commons: remove persistence-commons-infinispan module reference - trusty: update to reference PostgreSQL/Redis instead of Infinispan
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 153 out of 154 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (4)
trusty/trusty-service/trusty-service-infinispan/src/main/resources/application.properties:1
- This configuration previously set default Infinispan credentials in
quarkus.infinispan-client.usernameandquarkus.infinispan-client.passwordusing values likeadmin, which constitutes hardcoded credentials. If these defaults are ever used in non-test environments (for example when the corresponding environment variables are not overridden), an attacker who can reach the Infinispan service can authenticate with full privileges. Removing this configuration and requiring credentials to be supplied securely at deploy time mitigates this risk; ensure no other production configs ship with similar built‑in secrets.
trusty/trusty-service/trusty-service-infinispan/src/main/resources/application.properties:1 - The property
quarkus.infinispan-client.sasl-mechanismhere defaulted toDIGEST-MD5, which relies on MD5 and is considered a weak and deprecated authentication mechanism. An attacker who can capture the SASL handshake can perform efficient offline dictionary attacks against MD5 digests, significantly weakening protection of the Infinispan credentials. Removing this default and requiring a stronger SASL mechanism (such as a SCRAM-SHA variant) reduces the risk of credential compromise.
jobs-service/jobs-service-infinispan/src/main/resources/application.properties:1 - This file previously configured default Infinispan credentials in
quarkus.infinispan-client.usernameandquarkus.infinispan-client.password(for exampleadmin/password), which are hardcoded secrets. If deployed without overriding these values, anyone who can reach the Infinispan endpoint can authenticate with these known credentials and gain unauthorized access to jobs data. Deleting this configuration removes the embedded credentials; ensure that any replacement configuration requires secrets to be injected securely rather than baked into source.
jobs-service/jobs-service-infinispan/src/main/resources/application.properties:1 - The
quarkus.infinispan-client.sasl-mechanismproperty here used a default ofDIGEST-MD5, a SASL mechanism based on the weak MD5 hash function. Attackers who can observe authentication traffic can leverage MD5 weaknesses to mount efficient offline password guessing attacks against these digests. By removing this configuration and avoiding DIGEST-MD5, the authentication flow no longer depends on a deprecated and weak algorithm and can rely on stronger mechanisms instead.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
26
to
31
| public class InfinispanKafkaTestProfile implements QuarkusTestProfile { | ||
|
|
||
| @Override | ||
| public List<TestResourceEntry> testResources() { | ||
| return Arrays.asList(new TestResourceEntry(KogitoServiceRandomPortQuarkusKafkaTestResource.class), | ||
| new TestResourceEntry(DataIndexInfinispanQuarkusKafkaTestResource.class)); | ||
| return Arrays.asList(new TestResourceEntry(KogitoServiceRandomPortQuarkusKafkaTestResource.class)); | ||
| } |
There was a problem hiding this comment.
InfinispanKafkaTestProfile no longer provisions any Infinispan-related test resources (it only registers KogitoServiceRandomPortQuarkusKafkaTestResource). The class name is now misleading and the file appears unused in the codebase. Consider either deleting it, or renaming it to reflect what it actually configures (and updating any references if they exist).
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove Infinispan as a persistence option as agreed in ML discussion.
Maintaining Infinispan support has become an unnecessary toll - dealing with API changes, upgrades, and transitive dependency security vulnerabilities outweighs its benefits. This simplifies maintenance and allows focus on better-supported options (PostgreSQL, MongoDB).
Related issue: apache/incubator-kie-issues#1914
Ensamble:
apache/incubator-kie-kogito-runtimes#4165
#2297
apache/incubator-kie-kogito-examples#2153
apache/incubator-kie-kogito-pipelines#1294