Openshift中的Infinispan（Red Hat Data Grid）和WebSphere Liberty

Question

我们正尝试在我们的OCP (4.5.36)集群中使用Red Hat Data Grid(RHDG)/Infinispan。我们安装了最新的官方RHDG操作器，并定义了缓存类型集群。(这显然是一个k8s StatefulSet。)

然后，我配置了一个WebSphere Liberty容器/部署，以尝试在其会话中使用该Infinispan集群，如https://github.com/WASdev/ci.docker#session-caching.

Infinispan 集群和 Liberty 部署都位于同一个项目/名称空间中。

然而，Liberty容器无法连接，Infinispan容器报告了自己的几个警告。

Liberty容器“客户端”日志：

INFINISPAN_SERVICE_NAME(original): session-infinispan
INFINISPAN_SERVICE_NAME(normalized): SESSION_INFINISPAN
INFINISPAN_HOST: 172.30.137.86
INFINISPAN_PORT: 11222
INFINISPAN_USER: developer
INFINISPAN_PASS: <redacted>

Launching defaultServer (WebSphere Application Server 21.0.0.3/wlp-1.0.50.cl210320210309-1101) on Eclipse OpenJ9 VM, version 1.8.0_282-b08 (en_US)
[AUDIT   ] CWWKE0001I: The server defaultServer has been launched.
[AUDIT   ] CWWKE0100I: This product is licensed for development, and limited production use. The full license terms can be viewed here: https://public.dhe.ibm.com/ibmdl/export/pub/software/websphere/wasdev/license/base_ilan/ilan/21.0.0.3/lafiles/en.html
[AUDIT   ] CWWKG0093A: Processing configuration drop-ins resource: /opt/ibm/wlp/usr/servers/defaultServer/configDropins/defaults/keystore.xml
[AUDIT   ] CWWKG0093A: Processing configuration drop-ins resource: /opt/ibm/wlp/usr/servers/defaultServer/configDropins/overrides/infinispan-client-sessioncache.xml
[AUDIT   ] CWWKZ0058I: Monitoring dropins for applications.
[AUDIT   ] CWWKT0016I: Web application available (default_host): http://payment-engine-6dcc5b6d5-jclx2:9080/payment/
[ERROR   ] ISPN004007: Exception encountered. Retry 10 out of 10
org.infinispan.client.hotrod.exceptions.TransportException:: ISPN004071: Connection to 172.30.137.86/172.30.137.86:11222 was closed while waiting for response.
[ERROR   ] SESN0307E: An exception occurred when initializing the cache. The exception is: org.infinispan.client.hotrod.exceptions.TransportException:: org.infinispan.client.hotrod.exceptions.TransportException:: ISPN004071: Connection to 172.30.137.86/172.30.137.86:11222 was closed while waiting for response.
    at org.infinispan.client.hotrod.impl.transport.netty.ActivationHandler.exceptionCaught(ActivationHandler.java:53)
    at io.netty.channel.AbstractChannelHandlerContext.invokeExceptionCaught(AbstractChannelHandlerContext.java:300)
...

Inifinispan容器日志的相关部分：

03:40:18,628 WARN  (SINGLE_PORT-ServerIO-4-2) [io.netty.handler.ssl.ApplicationProtocolNegotiationHandler] [id: 0xc39380c8, L:/10.254.0.248:11222 ! R:/10.254.2.65:32986] TLS handshake failed: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: a0061e21000003ffffffff0f0000
    at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1254)

（实际上，有几个Infinispan初创公司的WARN，大多是关于弃用的功能。但这是唯一一个具有堆栈跟踪的WARN，所以我很快得出结论，这可能是“罪魁祸首”）

此外，这是 Infinispan 服务，因此您可以看到 IP 和端口与 Liberty 容器正在使用的内容相匹配：

Answer 1

在Infinispan聊天服务上解决这个问题，看起来SSL/TLS的设置不正确或不完整。

我曾试图移除Infinispan集群中的加密，但我要么没有充分重启组件，要么无法在事后进行更改。但是，移除集群并在禁用集群的情况下重新创建集群，可以使Liberty通信正常工作。

以下CR YAML工作：

apiVersion: infinispan.org/v1
kind: Infinispan
metadata:
  name: session-infinispan
spec:
  replicas: 1
  service:
    type: Cache 
  security:
    endpointEncryption:
      type: None

现在来探讨Liberty设置中缺少的内容，以正确使用SSL。Infinispan聊天对话说官方图像中的这个Liberty XML设置：

xml prettyprint-override"><server>
  <featureManager>
    <feature>sessionCache-1.0</feature>
  </featureManager>
  <httpSessionCache libraryRef="InfinispanLib">
    <properties infinispan.client.hotrod.server_list="${INFINISPAN_HOST}:${INFINISPAN_PORT}"/>
    <properties infinispan.client.hotrod.marshaller="org.infinispan.commons.marshall.JavaSerializationMarshaller"/>
    <properties infinispan.client.hotrod.java_serial_whitelist=".*"/>
    <properties infinispan.client.hotrod.auth_username="${INFINISPAN_USER}"/>
    <properties infinispan.client.hotrod.auth_password="${INFINISPAN_PASS}"/>
    <properties infinispan.client.hotrod.auth_realm="default"/>
    <properties infinispan.client.hotrod.sasl_mechanism="DIGEST-MD5"/>
    <properties infinispan.client.hotrod.auth_server_name="infinispan"/>
  </httpSessionCache>
  <httpSessionCache enableBetaSupportForInfinispan="true"/> <!-- TODO remove once no longer gated -->
  <library id="InfinispanLib">
    <fileset dir="${shared.resource.dir}/infinispan" includes="*.jar"/>
  </library>
</server>

需要添加以下属性：

# Encryption
infinispan.client.hotrod.sni_host_name=$SERVICE_HOSTNAME
# Path to the TLS certificate.
# Clients automatically generate trust stores from certificates.
infinispan.client.hotrod.trust_store_path=/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt