kafka-ssl in fips

integration-tests-support/certificate-generator/pom.xml

@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one or more
+    contributor license agreements.  See the NOTICE file distributed with
+    this work for additional information regarding copyright ownership.
+    The ASF licenses this file to You under the Apache License, Version 2.0
+    (the "License"); you may not use this file except in compliance with
+    the License.  You may obtain a copy of the License at
+
+         http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.apache.camel.quarkus</groupId>
+        <artifactId>camel-quarkus-integration-tests-support</artifactId>
+        <version>3.11.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>camel-quarkus-integration-tests-support-certificate-generator</artifactId>
+    <name>Camel Quarkus :: Integration Tests :: Support :: Certificate generator</name>
+
+    <dependencies>
+        <dependency>
+            <groupId>me.escoffier.certs</groupId>
+            <artifactId>certificate-generator-junit5</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.camel.quarkus</groupId>
+            <artifactId>camel-quarkus-integration-test-support</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-junit4-mock</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>testcontainers</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>junit</groupId>
+                    <artifactId>junit</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.jboss.jandex</groupId>
+                <artifactId>jandex-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>make-index</id>
+                        <goals>
+                            <goal>jandex</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>
+

integration-tests-support/certificate-generator/src/main/java/org/apache/camel/quarkus/test/support/certificate/TestCertificateGenerationExtension.java

@@ -0,0 +1,127 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.quarkus.test.support.certificate;
+
+import java.io.File;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Optional;
+
+import me.escoffier.certs.AliasRequest;
+import me.escoffier.certs.CertificateFiles;
+import me.escoffier.certs.CertificateGenerator;
+import me.escoffier.certs.CertificateRequest;
+import me.escoffier.certs.junit5.Alias;
+import me.escoffier.certs.junit5.Certificate;
+import org.jboss.logging.Logger;
+import org.junit.jupiter.api.extension.*;
+import org.junit.platform.commons.util.AnnotationUtils;
+import org.testcontainers.DockerClientFactory;
+
+/**
+ * Extension is based on
+ * https://github.com/cescoffier/certificate-generator/blob/main/certificate-generator-junit5/src/main/java/me/escoffier/certs/junit5/CertificateGenerationExtension.java
+ *
+ * Unfortunately there is no way of extending the original Extension with functionality of modifying CN and
+ * SubjectAlternativeName
+ * based on docker host (required for usage with external docker host)
+ * Therefore I created a new annotation 'TestCertificates' which would use this new extension.
+ */
+public class TestCertificateGenerationExtension implements BeforeAllCallback, ParameterResolver {
+    private static final Logger LOGGER = Logger.getLogger(TestCertificateGenerationExtension.class);
+
+    public static TestCertificateGenerationExtension getInstance(ExtensionContext extensionContext) {
+        return extensionContext.getStore(ExtensionContext.Namespace.GLOBAL)
+                .get(TestCertificateGenerationExtension.class, TestCertificateGenerationExtension.class);
+    }
+
+    List<CertificateFiles> certificateFiles = new ArrayList<>();
+
+    @Override
+    public void beforeAll(ExtensionContext extensionContext) throws Exception {
+
+        extensionContext.getStore(ExtensionContext.Namespace.GLOBAL)
+                .getOrComputeIfAbsent(TestCertificateGenerationExtension.class, c -> this);
+        var maybe = AnnotationUtils.findAnnotation(extensionContext.getRequiredTestClass(), TestCertificates.class);
+        if (maybe.isEmpty()) {
+            return;
+        }
+        var annotation = maybe.get();
+
+        //cn and alternativeSubjectName might be different (to reflect docker host)
+        Optional<String> cn = resolveDockerHost();
+        Optional<String> altSubName = cn.stream().map(h -> "IP:%s".formatted(h)).findAny();
+
+        for (Certificate certificate : annotation.certificates()) {
+            String baseDir = annotation.baseDir();
+            File file = new File(baseDir);
+            file.mkdirs();
+            CertificateGenerator generator = new CertificateGenerator(file.toPath(), annotation.replaceIfExists());
+
+            CertificateRequest request = new CertificateRequest()
+                    .withName(certificate.name())
+                    .withClientCertificate(certificate.client())
+                    .withFormats(Arrays.asList(certificate.formats()))
+                    .withCN(cn.orElse(certificate.cn()))
+                    .withPassword(certificate.password().isEmpty() ? null : certificate.password())
+                    .withDuration(Duration.ofDays(certificate.duration()));
+
+            if (altSubName.isPresent()) {
+                request.withSubjectAlternativeName(altSubName.get());
+            }
+
+            for (String san : certificate.subjectAlternativeNames()) {
+                request.withSubjectAlternativeName(san);
+            }
+
+            for (Alias alias : certificate.aliases()) {
+                AliasRequest nested = new AliasRequest()
+                        .withCN(alias.cn())
+                        .withPassword(alias.password())
+                        .withClientCertificate(alias.client());
+                request.withAlias(alias.name(), nested);
+                for (String s : alias.subjectAlternativeNames()) {
+                    nested.withSubjectAlternativeName(s);
+                }
+            }
+
+            certificateFiles.addAll(generator.generate(request));
+        }
+    }
+
+    private Optional<String> resolveDockerHost() {
+        String dockerHost = DockerClientFactory.instance().dockerHostIpAddress();
+        if (!dockerHost.equals("localhost") && !dockerHost.equals("127.0.0.1")) {
+            return Optional.of(dockerHost);
+        }
+        return Optional.empty();
+    }
+
+    @Override
+    public boolean supportsParameter(ParameterContext parameterContext, ExtensionContext extensionContext)
+            throws ParameterResolutionException {
+        throw new IllegalArgumentException("Not supported!");
+    }
+
+    @Override
+    public Object resolveParameter(ParameterContext parameterContext, ExtensionContext extensionContext)
+            throws ParameterResolutionException {
+        throw new IllegalArgumentException("Not supported!");
+    }
+}

integration-tests-support/certificate-generator/src/main/java/org/apache/camel/quarkus/test/support/certificate/TestCertificates.java

@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.quarkus.test.support.certificate;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Inherited;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import me.escoffier.certs.junit5.Certificate;
+import org.junit.jupiter.api.extension.ExtendWith;
+
+/**
+ * Based on
+ * https://github.com/cescoffier/certificate-generator/blob/main/certificate-generator-junit5/src/main/java/me/escoffier/certs/junit5/Certificates.java
+ * Generates certificates before the tests via 'TestCertificateGenerationExtension' so the new certificates
+ * are customized to fullfill a remote docker host (if required).
+ */
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@ExtendWith(TestCertificateGenerationExtension.class)
+@Inherited
+public @interface TestCertificates {
+
+    /**
+     * The base directory in which certificates will be generated.
+     */
+    String baseDir();
+
+    /**
+     * The certificates to generate.
+     * Must not be empty.
+     */
+    Certificate[] certificates();
+
+    /**
+     * Whether to replace the certificates if they already exist.
+     */
+    boolean replaceIfExists() default false;
+}

integration-tests-support/kafka/pom.xml

@@ -52,6 +52,10 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-junit4-mock</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.apache.camel.quarkus</groupId>
+            <artifactId>camel-quarkus-integration-test-support</artifactId>
+        </dependency>
     </dependencies>
 
     <build>

integration-tests-support/kafka/src/main/java/org/apache/camel/quarkus/test/support/kafka/KafkaTestResource.java

@@ -18,38 +18,96 @@
 
 import java.util.Collections;
 import java.util.Map;
+import java.util.function.Function;
 
+import com.github.dockerjava.api.exception.NotFoundException;
 import io.quarkus.test.common.QuarkusTestResourceLifecycleManager;
 import io.strimzi.test.container.StrimziKafkaContainer;
+import org.apache.camel.quarkus.test.FipsModeUtil;
 import org.eclipse.microprofile.config.ConfigProvider;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.testcontainers.containers.ContainerFetchException;
+import org.testcontainers.containers.GenericContainer;
+import org.testcontainers.images.builder.ImageFromDockerfile;
 import org.testcontainers.utility.TestcontainersConfiguration;
 
 public class KafkaTestResource implements QuarkusTestResourceLifecycleManager {
     protected static final String KAFKA_IMAGE_NAME = ConfigProvider.getConfig().getValue("kafka.container.image", String.class);
     private static final Logger LOGGER = LoggerFactory.getLogger(KafkaTestResource.class);
 
     private StrimziKafkaContainer container;
+    private GenericContainer j17container;
 
     @Override
     public Map<String, String> start() {
         LOGGER.info(TestcontainersConfiguration.getInstance().toString());
 
         try {
-            container = new StrimziKafkaContainer(KAFKA_IMAGE_NAME)
-                    /* Added container startup logging because of https://github.com/apache/camel-quarkus/issues/2461 */
-                    .withLogConsumer(frame -> System.out.print(frame.getUtf8String()))
-                    .waitForRunning();
-
-            container.start();
+            startContainer(KAFKA_IMAGE_NAME, name -> new StrimziKafkaContainer(name));
 
             return Collections.singletonMap("camel.component.kafka.brokers", container.getBootstrapServers());
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
     }
 
+    public String start(Function<String, StrimziKafkaContainer> containerSupplier) {
+        LOGGER.info(TestcontainersConfiguration.getInstance().toString());
+
+        //if FIPS environment is present, custom container using J17 has to used because:
+        // Password-based encryption support in FIPs mode was implemented in the Red Hat build of OpenJDK 17 update 4
+        if (FipsModeUtil.isFipsMode()) {
+            //custom image should be cached for the next usages with following id
+            String customImageName = "camel-quarkus-test-custom-" + KAFKA_IMAGE_NAME.replaceAll("[\\./]", "-");
+
+            try {
+                //in case that the image is not accessible, fetch exception is thrown
+                startContainer(customImageName, containerSupplier);
+            } catch (ContainerFetchException e) {
+                if (e.getCause() instanceof NotFoundException) {
+                    LOGGER.info("Custom image for kafka (%s) does not exist. Has to be created.", customImageName);
+
+                    //start of the customized container will create the image
+                    //it is not possible to customize existing StrimziKafkaContainer. Testcontainer API doe not allow
+                    //to customize the image.
+                    // This workaround can be removed once the strimzi container with openjdk 17 is released.
+                    // According to https://strimzi.io/blog/2023/01/25/running-apache-kafka-on-fips-enabled-kubernetes-cluster/
+                    // image should exist
+                    j17container = new GenericContainer(
+                            new ImageFromDockerfile(customImageName, false)
+                                    .withDockerfileFromBuilder(builder -> builder
+                                            .from("quay.io/strimzi-test-container/test-container:latest-kafka-3.2.1")
+                                            .env("JAVA_HOME", "/usr/lib/jvm/jre-17")
+                                            .env("PATH", "/usr/lib/jvm/jre-17/bin:$PATH")
+                                            .user("root")
+                                            .run("microdnf install -y --nodocs java-17-openjdk-headless glibc-langpack-en && microdnf clean all")));
+                    j17container.start();
+
+                    LOGGER.info("Custom image for kafka (%s) has been created.", customImageName);
+
+                    //start kafka container again
+                    startContainer(customImageName, containerSupplier);
+                }
+            }
+        } else {
+            startContainer(KAFKA_IMAGE_NAME, containerSupplier);
+        }
+
+        return container.getBootstrapServers();
+
+    }
+
+    private void startContainer(String imageName, Function<String, StrimziKafkaContainer> containerSupplier) {
+        container = containerSupplier.apply(imageName);
+
+        /* Added container startup logging because of https://github.com/apache/camel-quarkus/issues/2461 */
+        container.withLogConsumer(frame -> System.out.print(frame.getUtf8String()))
+                //                .withEnv("KAFKA_LOG4J_OPTS", "-Dlog4j.configuration=file:/log4j.properties")
+                .waitForRunning()
+                .start();
+    }
+
     @Override
     public void stop() {
         if (container != null) {
@@ -59,11 +117,19 @@ public void stop() {
                 // ignored
             }
         }
+        if (j17container != null) {
+            try {
+                j17container.stop();
+            } catch (Exception e) {
+                // ignored
+            }
+        }
     }
 
     @Override
     public void inject(TestInjector testInjector) {
         testInjector.injectIntoFields(container,
                 new TestInjector.AnnotatedAndMatchesType(InjectKafka.class, StrimziKafkaContainer.class));
     }
+
 }