Skip to content

chore: simplify TLS CLI scripts using security enable-ssl-http-server - #524

Closed
jmesnil wants to merge 12 commits into
wildfly-extras:mainfrom
jmesnil:worktree-simplify-tls-cli
Closed

chore: simplify TLS CLI scripts using security enable-ssl-http-server#524
jmesnil wants to merge 12 commits into
wildfly-extras:mainfrom
jmesnil:worktree-simplify-tls-cli

Conversation

@jmesnil

@jmesnil jmesnil commented Oct 19, 2026

Copy link
Copy Markdown
Member

Summary

  • Replace the four individual Elytron management operations in configure-elytron-tls.cli with a single security enable-ssl-http-server command
  • Add a follow-up write-attribute enable-http2=true on the https-listener (required for gRPC; the security command does not set it)
  • Switch idempotency guard from UUID key-store existence to https-listener existence — a more meaningful sentinel
  • Replace UUID-based resource names (key-store-afcdd1f8-…, ssl-context-afcdd1f8-…, etc.) with readable grpc-key-store, grpc-key-manager, grpc-ssl-context, grpc-trust-store, grpc-trust-manager names throughout both CLI scripts and the two-way TLS Arquillian setup tasks

Test plan

  • mvn clean install passes (22 integration tests green, all modules succeed)
  • One-way TLS provisioning executes security enable-ssl-http-server --add-https-listener then sets enable-http2=true
  • Two-way TLS tests (TwowaySecureHelloWorldTest, TwowaySecureStreamingTest) pass with the updated grpc-* resource names

🤖 Generated with Claude Code

jmesnil and others added 12 commits October 14, 2026 09:54
@jmesnil @claude
Replace Netty gRPC server with Undertow servlet-based implementation
3b8c64f 
Replace the standalone Netty-based gRPC server with a servlet filter
registered on WildFly's existing Undertow HTTP/2 stack, using
io.grpc.servlet.jakarta to dispatch gRPC requests to BindableService
implementations.

Key changes:

* GrpcUndertowService replaces GrpcServerService: registers a servlet
  filter on the Undertow virtual host instead of starting a dedicated
  Netty server on port 9555. gRPC traffic is routed by Content-Type
  prefix (application/grpc) via an Undertow predicate; all other
  traffic falls through to the existing handler chain.

* Netty removed: drop grpc-netty-shaded, grpc-sockets.xml socket
  binding, OkHttp, and Kotlin stdlib from Maven deps and JBoss modules.
  Add io.grpc:grpc-servlet-jakarta as the only new runtime dependency.

* Transport attributes removed: attributes tied to the Netty/gRPC
  transport layer (flow control, keep-alive, handshake-timeout, etc.)
  are removed from the management model. A migration guide
  (doc/migration.md) maps each removed attribute to its Undertow
  equivalent or explains why it no longer applies.

* Schema bumped to preview:2.0 to reflect the breaking model change.

* Integration tests updated: ports changed from 9555 to 8080/8443,
  removed gRPC transport attributes from test configs, regenerated
  expired TLS certificates, added GrpcHttpCoexistenceTest verifying
  that JAX-RS endpoints continue to work when gRPC routing is active.

* Helloworld example updated: WAR packaging, pre-deployed service,
  preview stability, h2c enabled on the default HTTP listener via the
  grpc Galleon feature group.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@jmesnil @claude
Fix build after rebase on wildfly/main
c565508 
- configure-elytron-tls.cli: remove stale grpc key-manager-name attribute
  (TLS is now handled by Undertow, not gRPC subsystem); add enable-http2=true
  to the https-listener
- examples/helloworld/service: copy SSL resources from ssl-gen instead of
  deleted ssl/ directory; run configure-elytron-tls.cli from generated output
- examples/helloworld/client: copy client.keystore.p12 from ssl-gen;
  use PKCS12 keystore for mutual-TLS channel credentials
- testsuite: copy client.keystore.p12 from ssl-gen; use PKCS12 keystore in
  TwowaySecureHelloWorldTest and TwowaySecureStreamingTest with SECURE_PORT

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@jmesnil @claude
Restore published v1.0 schema, fix subsystem pom, improve TLS tests
1135b9a 
Schema:
- wildfly-grpc_preview_1_0.xsd: restore to published state; breaking changes
  belong in the new wildfly-grpc_preview_2_0.xsd only

Subsystem pom:
- Remove explicit <release>17</release> from maven-compiler-plugin and
  maven-javadoc-plugin; the root pom already sets maven.compiler.release via
  jdk.min.version=17

TLS test improvements:
- Provision server with one-way TLS via configure-elytron-tls.cli packaging
  script (wildfly-maven-plugin:package goal, stability=preview)
- OnewaySecure tests: remove ServerSetupTask; server has TLS at start
- TwowaySecure tests: reduce setup to mutual-TLS delta only (trust-store +
  trust-manager + ssl-context update using UUID names from the CLI script)
- Fix copy/paste bug in TwowaySecureStreamingTest.createTestArchive
- Remove stale /subsystem=grpc:write-attribute(name=trust-manager-name) from
  configure-elytron-mutual-tls.cli

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@jmesnil @claude
Update README files for Undertow-based gRPC implementation
31590fb 
- Root README: fix port references (8080/8443 replace old 9555), correct
  grpcurl CA cert path (client.truststore.pem, not ca.pem), correct client
  cert path (client.crt.pem, not client.keystore.pem), update Chat section
  to use mvn clean package instead of wildfly:run
- examples/helloworld/README.md: full rewrite — correct ports, stability flag
  syntax, grpcurl examples, client invocation from project root
- examples/chat/README.md: update stability flag syntax, align with helloworld
  style (prerequisites, package-then-run, project-root client commands)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@jmesnil @claude
Remove ServletConfiguration record; inline fields into GrpcUndertowSe…
990e6f5 
…rvice

The two-field record added no value. maxInboundMessageSize and
maxInboundMetadataSize are now passed directly as constructor parameters.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@jmesnil
chore: use consistent tests naming convention
2c7d58a 
Signed-off-by: Jeff Mesnil <jmesnil@redhat.com>
@jmesnil
chore: Update README.md
db7b7a1 
Signed-off-by: Jeff Mesnil <jmesnil@redhat.com>
@jmesnil
chore: add back the jdk9 profile
fcc5e06 
Signed-off-by: Jeff Mesnil <jmesnil@redhat.com>
@jmesnil
chore: update examples READMEs
8504d8c 
Signed-off-by: Jeff Mesnil <jmesnil@redhat.com>
@jmesnil
chore: revert changes to GrpcDeploymentProcessor
3d6aff8 
Signed-off-by: Jeff Mesnil <jmesnil@redhat.com>
@jmesnil
chore: fix HTTP(S) ports for the examples
abe4179 
Signed-off-by: Jeff Mesnil <jmesnil@redhat.com>
@jmesnil @claude
chore: simplify TLS CLI scripts using security enable-ssl-http-server
996f3ca 
Replace the four individual Elytron management operations in
configure-elytron-tls.cli with a single `security enable-ssl-http-server`
command (plus a follow-up write-attribute to enable HTTP/2, which gRPC
requires and the security command does not set). Switch from UUID-based
resource names to readable grpc-* names throughout both CLI scripts and
the two-way TLS test setup tasks.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@jmesnil
jmesnil requested a review from hpehl as a code owner October 19, 2026 08:29
@jmesnil jmesnil closed this Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hpehl hpehl Awaiting requested review from hpehl hpehl is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jmesnil