SSL环境中的SpringBoot+Eureka+CloudConfig

Question

Eureka Discovery服务器（包括/config/*服务器上的云配置服务）正在向Eureka服务器注册，并且Eureka仪表板显示了该实例。此服务在端口9001上运行,启用SSL并进行用户身份验证。服务照常工作。

然后我创建了一个新的SpringBoot服务，它连接到Eureka并注册到它。由于使用了自签名证书，我在这篇文章中编写了一个小的SSLConfguration类：如何覆盖Spring Cloud Eureka default discovery client默认ssl上下文？将我的个人信任库提供给底层的eurekaclient。我们的所有服务都使用application.yml配置：

spring:
    application:
        name: mark2

server:
    port: 9998
    ssl:
        enabled: true
        key-store: classpath:keystore.p12
        key-store-password: changeit
        key-store-type: PKCS12
        keyAlias: mark2

http:
    client:
      ssl:
          trust-store: classpath:keystore.p12
          trust-store-password: changeit

eureka:
    client:
        serviceUrl:
            defaultZone: https://user:pass@localhost:9001/eureka

客户端完全连接和注册。

spring:
    application:
        name: mark2
    cloud:
        config:
            username: user
            password: password
            discovery:
                enabled: true
                serviceId: EUREKA-DISCOVERY-SERVICE
            failFast: true
            name: my
            profile: settings
#            label: v1

http:
    client:
      ssl:
          trust-store: classpath:keystore.p12
          trust-store-password: changeit

eureka:
    client:
        serviceUrl:
            defaultZone: https://user:password@localhost:9001/eureka
    instance:
        metadataMap:
            user: user
            password: password
            configPath: /config

好的，然后我用javax.net.ssl.truststore等将JVM参数设置为我的个人信任库。

bootRun {
   jvmArgs = [ 
     "-Djavax.net.ssl.trustStore=/absolute/path/to/keystore.p12", 
     "-Djavax.net.ssl.trustStorePassword=changeit", 
     "-Djavax.net.ssl.trustStoreType=PKCS12", 
   ]
}

服务启动，Eureka客户端开始与Eureka服务器通信，查找云配置实例并加载属性文件，然后创建Spring上下文。该属性仅包含一些测试属性。

但是然后-错误：

Field optionalArgs in org.springframework.cloud.netflix.eureka.EurekaClientAutoConfiguration$RefreshableEurekaClientConfiguration required a single bean, but 2 were found:
    - getTrustStoredEurekaClient: defined by method 'getTrustStoredEurekaClient' in class path resource [de/mark2/SslConfiguration.class]
    - discoveryClientOptionalArgs: defined by method 'discoveryClientOptionalArgs' in org.springframework.cloud.netflix.eureka.config.DiscoveryClientOptionalArgsConfiguration

Answer 1

定义meta-inf/spring.factories，并添加org.springframework.cloud.bootstrap.bootstrapconfiguration=...行

类可以类似于：

@Configuration
@BootstrapConfiguration
public class SslConfiguration {
  @Value("${http.client.ssl.trust-store}")
  private URL trustStore;
  @Value("${http.client.ssl.trust-store-password}")
  private String trustStorePassword;

  @Bean
  public DiscoveryClient.DiscoveryClientOptionalArgs getTrustStoredEurekaClient(SSLContext sslContext) {
    DiscoveryClient.DiscoveryClientOptionalArgs args = new DiscoveryClient.DiscoveryClientOptionalArgs();
    args.setSSLContext(sslContext);
    return args;
  }

  @Bean
  public SSLContext sslContext() throws Exception {
    return new SSLContextBuilder().loadTrustMaterial(trustStore, trustStorePassword.toCharArray()).build();
  }
}

因为DiscoveryClientOptionalArgs现在定义了两次，所以添加另一个类，在Spring上下文启动后加载

@Configuration
public class DiscoveryServiceConfiguration {
  @Bean
  public static BeanFactoryPostProcessor registerPostProcessor() {
    return (ConfigurableListableBeanFactory beanFactory) -> {
      BeanDefinitionRegistry registry = (BeanDefinitionRegistry) beanFactory;
      for (String beanDefinitionName : registry.getBeanDefinitionNames()) {
        if (beanDefinitionName.equalsIgnoreCase("discoveryClientOptionalArgs")) {
          BeanDefinition beanDefinition = registry.containsBeanDefinition(beanDefinitionName) ? registry.getBeanDefinition(beanDefinitionName) : null;
          if (beanDefinition != null) {
            if (registry.containsBeanDefinition(beanDefinitionName)) {
              registry.removeBeanDefinition(beanDefinitionName);
            }
          }
        }
      }
    };
  }
}