Fix per-endpoint TLS/cleartext switching for xDS clusters with mixed transport_socket_matches

[jrhee17]

Motivation:

When an xDS cluster has mixed TLS and plaintext endpoints (via transport_socket_matches), the session protocol must switch dynamically per endpoint. Previously, ClusterFilterFactory picked a fixed session protocol at cluster level based on whether a default transport_socket was present. This meant all endpoints in a cluster used the same TLS/cleartext setting, which broke mixed clusters where some endpoints use UpstreamTlsContext and others use raw_buffer.

Modifications:

• Changed ClusterFilterFactory to always default to a TLS session protocol (based on HttpProtocolOptions), and defer per-endpoint TLS decisions to the applyClusterSettings decorator. When the endpoint's TransportSocketSnapshot has no ClientTlsSpec (i.e., raw_buffer), clearClientTlsSpec() is called to switch the protocol to cleartext.
• Removed the transportSocket parameter from the ClusterFilterFactory constructor since TLS is no longer decided at cluster level.
• Updated ClusterStream accordingly to stop passing transportSocket to the constructor.
• Added MixedTransportSocketSessionProtocolTest verifying that a round-robin cluster with one TLS endpoint and one plaintext endpoint uses the correct session protocol for each.
• Added MixedTransportSocketRetryTest verifying that retry-created derived contexts also get the correct per-endpoint session protocol when retrying across mixed endpoints through real server connections.

Result:

• Clusters with transport_socket_matches containing both TLS and raw_buffer entries now correctly switch between TLS and cleartext per endpoint.
• Retry attempts across mixed endpoints preserve the correct session protocol in each derived context.

[coderabbitai]

📝 Walkthrough

Walkthrough

The xDS client now derives session protocols from HTTP protocol options and clears TLS settings for plaintext endpoints. New integration tests cover mixed TLS/plaintext endpoint selection during round-robin requests and retries.

Changes

xDS mixed transport session protocol handling

Layer / File(s)	Summary
Cluster session protocol derivation and wiring xds/src/main/java/com/linecorp/armeria/xds/ClusterFilterFactory.java, xds/src/main/java/com/linecorp/armeria/xds/ClusterStream.java	ClusterFilterFactory derives protocols from HttpProtocolOptions, clears ClientTlsSpec for plaintext endpoints, and no longer receives the transport socket.
Mixed endpoint session protocol validation it/xds-client/src/test/java/com/linecorp/armeria/xds/it/MixedTransportSocketSessionProtocolTest.java	Adds round-robin integration coverage for TLS and plaintext endpoints, including endpoint-specific protocol assertions and certificate encoding.
Mixed endpoint retry validation it/xds-client/src/test/java/com/linecorp/armeria/xds/it/MixedTransportSocketRetryTest.java	Adds retry integration coverage that checks child request contexts and endpoint-specific session protocols across failed requests.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• line/armeria#6843: Introduces the HttpProtocolOptions-based session protocol handling refined by this PR.
• line/armeria#6852: Updates related xDS request-context TLS and session protocol handling.
• line/armeria#6886: Covers related mixed TLS/plaintext endpoint handling and retry behavior.

Suggested labels: new feature, improvement

Suggested reviewers: ikhoon, minwoox

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the fix for per-endpoint TLS and cleartext switching in mixed xDS clusters.
Description check	✅ Passed	The description accurately explains the mixed transport issue, implementation changes, and added tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

it/xds-client/src/test/java/com/linecorp/armeria/xds/it/MixedTransportSocketRetryTest.java (1)

195-197: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider extracting base64Cert to a shared utility.

The base64Cert method is duplicated verbatim in MixedTransportSocketSessionProtocolTest. Consider extracting it (and XdsCertificateExtension if co-located) to a shared test helper in the same package to reduce duplication.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@it/xds-client/src/test/java/com/linecorp/armeria/xds/it/MixedTransportSocketRetryTest.java`
around lines 195 - 197, The `base64Cert` helper is duplicated in
`MixedTransportSocketRetryTest` and `MixedTransportSocketSessionProtocolTest`;
move it into a shared test utility in the same package and update both tests to
call that shared helper. If `XdsCertificateExtension` belongs with it, co-locate
that logic in the same helper so the duplicated certificate-loading code is
centralized and easier to maintain.

core/src/test/java/com/linecorp/armeria/internal/client/DefaultClientRequestContextTest.java (1)

447-552: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

LGTM on the new setSessionProtocol tests — they're logically consistent with the implementation. One gap: this file doesn't directly test setClientTlsSpec()/clearClientTlsSpec() driving the sessionProtocol TLS/cleartext switch (lines 1112-1126 in DefaultClientRequestContext.java), only setSessionProtocol() itself. Consider adding a test mirroring the existing pattern to cover that path directly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@core/src/test/java/com/linecorp/armeria/internal/client/DefaultClientRequestContextTest.java`
around lines 447 - 552, The new tests cover setSessionProtocol() directly, but
they do not exercise the TLS/cleartext transition triggered by
setClientTlsSpec() and clearClientTlsSpec(). Add a test in
DefaultClientRequestContextTest that follows the existing init/update assertions
and verifies that calling setClientTlsSpec() switches sessionProtocol() and
URI/header scheme to HTTPS, and clearClientTlsSpec() switches them back to HTTP.
Use the existing DefaultClientRequestContext, sessionProtocol(), uri(), and
internalRequestHeaders() patterns to keep the coverage aligned with the current
tests.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@core/src/test/java/com/linecorp/armeria/internal/client/DefaultClientRequestContextTest.java`:
- Around line 447-552: The new tests cover setSessionProtocol() directly, but
they do not exercise the TLS/cleartext transition triggered by
setClientTlsSpec() and clearClientTlsSpec(). Add a test in
DefaultClientRequestContextTest that follows the existing init/update assertions
and verifies that calling setClientTlsSpec() switches sessionProtocol() and
URI/header scheme to HTTPS, and clearClientTlsSpec() switches them back to HTTP.
Use the existing DefaultClientRequestContext, sessionProtocol(), uri(), and
internalRequestHeaders() patterns to keep the coverage aligned with the current
tests.

In
`@it/xds-client/src/test/java/com/linecorp/armeria/xds/it/MixedTransportSocketRetryTest.java`:
- Around line 195-197: The `base64Cert` helper is duplicated in
`MixedTransportSocketRetryTest` and `MixedTransportSocketSessionProtocolTest`;
move it into a shared test utility in the same package and update both tests to
call that shared helper. If `XdsCertificateExtension` belongs with it, co-locate
that logic in the same helper so the duplicated certificate-loading code is
centralized and easier to maintain.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8870940b-b434-4f1e-96ba-66b192801121

📥 Commits

Reviewing files that changed from the base of the PR and between fe73b6c and b9813b3.

📒 Files selected for processing (9)

• core/src/main/java/com/linecorp/armeria/client/ClientRequestContext.java
• core/src/main/java/com/linecorp/armeria/client/ClientRequestContextWrapper.java
• core/src/main/java/com/linecorp/armeria/common/SessionProtocol.java
• core/src/main/java/com/linecorp/armeria/internal/client/DefaultClientRequestContext.java
• core/src/test/java/com/linecorp/armeria/internal/client/DefaultClientRequestContextTest.java
• it/xds-client/src/test/java/com/linecorp/armeria/xds/it/MixedTransportSocketRetryTest.java
• it/xds-client/src/test/java/com/linecorp/armeria/xds/it/MixedTransportSocketSessionProtocolTest.java
• xds/src/main/java/com/linecorp/armeria/xds/ClusterFilterFactory.java
• xds/src/main/java/com/linecorp/armeria/xds/ClusterStream.java

[github-actions]

🔍 Build Scan® (commit: 1bdd051)

Job name	Status	Build Scan®
build-ubicloud-standard-16-jdk-8	✅	https://ge.armeria.dev/s/4cpecyinj6txi
build-ubicloud-standard-16-jdk-25	✅	https://ge.armeria.dev/s/mdq7kfq4itg7k
build-ubicloud-standard-16-jdk-21-snapshot-blockhound	✅	https://ge.armeria.dev/s/7bnq3bo54gekm
build-ubicloud-standard-16-jdk-17-min-java-17-coverage	✅	https://ge.armeria.dev/s/eygaspqpe4iio
build-ubicloud-standard-16-jdk-17-min-java-11	✅	https://ge.armeria.dev/s/fawbenh3v2t2m
build-ubicloud-standard-16-jdk-17-leak	✅	https://ge.armeria.dev/s/hxvkg5tnmdb4k
build-ubicloud-standard-16-jdk-11	✅	https://ge.armeria.dev/s/ujk424l5hwqii
build-macos-latest-jdk-25	✅	https://ge.armeria.dev/s/4clcmsbmzx7da

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (8150425) to head (1bdd051).
⚠️ Report is 579 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #6850       +/-   ##
============================================
- Coverage     74.46%       0   -74.47%     
============================================
  Files          1963       0     -1963     
  Lines         82437       0    -82437     
  Branches      10764       0    -10764     
============================================
- Hits          61385       0    -61385     
+ Misses        15918       0    -15918     
+ Partials       5134       0     -5134     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.