Support gRPC TLS communication and TLS registry and FW support for gRPC on same server

[michalvavrik]

Summary

• Adds support for gRPC running on same Vert.X HTTP server (which shall be primary Quarkus way in the future, not legacy separate server).
• Closes: GrpcService is not compatible with grpc server running on the same port as http #1048
• Closes: gRPC channel stays open after test #1054
• Adds support for TLS and mTLS communication with gRPC service
• Integrates TLS registry support
• I needed to use Netty directly (which according to my debugging was used anyway, it is one of hardcoded classes in gRPC core and it was selected by default provider in cases I debugged without changes in this PR). This allows me to work with SSL context.
• I had issue with managed context, which I can see in our TS we also had, see https://github.com/quarkus-qe/quarkus-test-suite/blob/38cdbd539b172db0d9e6334759df3487ac8864fe/http/grpc/src/test/java/io/quarkus/ts/http/grpc/XeparateServerIT.java#L13 so from now on, I am returning managed channel has method scope. I looked how is it done upstream and I can see using AfterEach and BeforeEach like here: https://github.com/quarkusio/quarkus/blob/main/integration-tests/grpc-mutual-auth/src/test/java/io/quarkus/grpc/examples/hello/HelloWorldMutualTlsServiceTest.java
• in regards of Quarkus QE Test Suite http/grpc module, I prepared changes in TS here quarkus-qe/quarkus-test-suite@14fdffb (that commit also adapts TS to other breaking changes I introduced in my other PRs before this one) and tested it with them:
  • seems to fix issues with closing channel, so that we can rename XeparateServer to SeparateServer (I only run it few times, I don't swear on it...)
  • SameServerIT https://github.com/quarkus-qe/quarkus-test-suite/blob/main/http/grpc/src/test/java/io/quarkus/ts/http/grpc/SameServerIT.java had to work around FW support for same server, this fixes it

Please check the relevant options

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Dependency update
• Refactoring
• Release (follows conventions described in the RELEASE.md)
• Breaking change (fix or feature that would cause existing functionality to change)
• This change requires a documentation update
• This change requires execution against OCP (use run tests phrase in comment)

Checklist:

• Example scenarios has been updated / added
• Methods and classes used in PR scenarios are meaningful
• Commits are well encapsulated and follow the best practices

[michalvavrik]

Issues on Windows are related to escaping, I don't know if I fixed them as obviously I didn't try it (it's bit late...). If it's red tomorrow, I'll work around that, but it's a small thing, I think you can freely comment on changes. Thanks

[michalvavrik]

Interesting, Quarkus turns -Dquarkus.tls.grpc-tls.trust-store.pem.certs="C:\Users\RUNNER~1\AppData\Local\Temp\quarkus-qe-certs809756706346777605\quarkus-qe-server-ca.crt" into:

2024-09-02T21:43:49.8846143Z 21:43:49,799 INFO  [app] Caused by: java.nio.file.NoSuchFileException: C:UsersRUNNER~1AppDataLocalTempquarkus-qe-certs809756706346777605quarkus-qe-server-ca.crt
2024-09-02T21:43:49.8847380Z 21:43:49,799 INFO  [app] 	at java.base/sun.nio.fs.WindowsException.translateToIOException(WindowsException.java:85)
2024-09-02T21:43:49.8848370Z 21:43:49,799 INFO  [app] 	at java.base/sun.nio.fs.WindowsException.rethrowAsIOException(WindowsException.java:103)
2024-09-02T21:43:49.8849385Z 21:43:49,799 INFO  [app] 	at java.base/sun.nio.fs.WindowsException.rethrowAsIOException(WindowsException.java:108)
2024-09-02T21:43:49.8850459Z 21:43:49,799 INFO  [app] 	at java.base/sun.nio.fs.WindowsFileSystemProvider.newByteChannel(WindowsFileSystemProvider.java:236)
2024-09-02T21:43:49.8851372Z 21:43:49,799 INFO  [app] 	at java.base/java.nio.file.Files.newByteChannel(Files.java:380)
2024-09-02T21:43:49.8852109Z 21:43:49,799 INFO  [app] 	at java.base/java.nio.file.Files.newByteChannel(Files.java:432)
2024-09-02T21:43:49.8852987Z 21:43:49,799 INFO  [app] 	at java.base/java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:422)
2024-09-02T21:43:49.8853880Z 21:43:49,799 INFO  [app] 	at java.base/java.nio.file.Files.newInputStream(Files.java:160)
2024-09-02T21:43:49.8854673Z 21:43:49,799 INFO  [app] 	at io.quarkus.tls.runtime.config.TlsConfigUtils.read(TlsConfigUtils.java:43)
2024-09-02T21:43:49.8855286Z 21:43:49,799 INFO  [app] 	... 20 more

I'll play with it tomorrow.

[michalvavrik]

Starting experiments on Windows, will report back when I fix it.

[michalvavrik]

I have doubled backslashes for my use case, which fixed the issue. I think we need to do it for everywhere #1275 but I do not there to do this in here. I am in hurry and don't have time to fix/debug side-effects in backports etc.

[fedinskiy]

We need a couple of small changes.

And what about Openshift? Will it work there?

[michalvavrik]

And what about Openshift? Will it work there?

#1053 IIRC you cannot have both enabled HTTP2 and HTTP1 in OpenShift cluster. Things might have changed, but it's beyond what I can do ATM.

[github-actions]

Following jobs contain at least one flaky test: 'Linux - JVM build - Released Versions'