Fix TLS configuration for WebClient Eureka transport

spring-cloud-netflix-eureka-client-tls-tests/pom.xml

@@ -48,6 +48,10 @@
 			<groupId>org.springframework</groupId>
 			<artifactId>spring-web</artifactId>
 		</dependency>
+                <dependency>
+                        <groupId>org.springframework.boot</groupId>
+                        <artifactId>spring-boot-starter-webflux</artifactId>
+                </dependency>
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-annotations</artifactId>

spring-cloud-netflix-eureka-client-tls-tests/src/test/java/org/springframework/cloud/netflix/eureka/EurekaClientSuite.java

@@ -26,7 +26,7 @@
  * That means that when the new context starts we will fail cause the executor service is
  * already shutdown.
  */
-@SelectClasses({ EurekaClientTests.class, RestClientEurekaClientTests.class })
+@SelectClasses({ EurekaClientTests.class, RestClientEurekaClientTests.class, WebClientEurekaClientTests.class })
 @Suite
 public class EurekaClientSuite {
 

spring-cloud-netflix-eureka-client-tls-tests/src/test/java/org/springframework/cloud/netflix/eureka/WebClientEurekaClientTests.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2018-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.cloud.netflix.eureka;
+
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+
+import org.springframework.boot.SpringBootConfiguration;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.cloud.configuration.TlsProperties;
+import org.springframework.cloud.netflix.eureka.http.WebClientDiscoveryClientOptionalArgs;
+import org.springframework.cloud.netflix.eureka.http.WebClientTransportClientFactories;
+import org.springframework.cloud.netflix.eureka.server.EnableEurekaServer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.web.reactive.function.client.WebClient;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.springframework.cloud.netflix.eureka.config.DiscoveryClientOptionalArgsConfiguration.setupTLS;
+
+/**
+ * Tests for verifying TLS setup with {@link WebClientTransportClientFactories}.
+ *
+ * @author Olga Maciaszek-Sharma
+ */
+public class WebClientEurekaClientTests extends BaseCertTests {
+
+	private static final Log LOG = LogFactory.getLog(WebClientEurekaClientTests.class);
+
+	private static EurekaServerRunner server;
+
+	private static EurekaClientRunner service;
+
+	@BeforeAll
+	public static void setupAll() {
+		server = startEurekaServer(TestEurekaServer.class);
+		service = startService(server, TestApp.class);
+		assertThat(service.discoveryClientOptionalArgs()).isInstanceOf(WebClientDiscoveryClientOptionalArgs.class);
+		LOG.info("Successfully asserted that WebClient will be used");
+		waitForRegistration(() -> new WebClientEurekaClientTests().createEurekaClient());
+	}
+
+	@AfterAll
+	public static void tearDownAll() {
+		stopService(service);
+		stopEurekaServer(server);
+	}
+
+	@Override
+	EurekaClientRunner createEurekaClient() {
+		return new EurekaClientRunner(TestApp.class, server);
+	}
+
+	@SpringBootConfiguration
+	@EnableAutoConfiguration
+	public static class TestApp {
+
+		@Bean
+		public WebClientDiscoveryClientOptionalArgs forceWebClientDiscoveryClientOptionalArgs(
+				TlsProperties tlsProperties) throws GeneralSecurityException, IOException {
+			WebClientDiscoveryClientOptionalArgs result = new WebClientDiscoveryClientOptionalArgs(WebClient::builder);
+			setupTLS(result, tlsProperties);
+			return result;
+		}
+
+		@Bean
+		public WebClientTransportClientFactories forceWebClientTransportClientFactories() {
+			return new WebClientTransportClientFactories(WebClient::builder);
+		}
+
+	}
+
+	@SpringBootConfiguration
+	@EnableAutoConfiguration
+	@EnableEurekaServer
+	public static class TestEurekaServer {
+
+	}
+
+}

spring-cloud-netflix-eureka-client/src/main/java/org/springframework/cloud/netflix/eureka/http/WebClientTransportClientFactories.java

@@ -52,7 +52,7 @@ public TransportClientFactory newTransportClientFactory(EurekaClientConfig clien
 	public TransportClientFactory newTransportClientFactory(final EurekaClientConfig clientConfig,
 			final Collection<Void> additionalFilters, final InstanceInfo myInstanceInfo,
 			final Optional<SSLContext> sslContext, final Optional<HostnameVerifier> hostnameVerifier) {
-		return new WebClientTransportClientFactory(builder);
+		return new WebClientTransportClientFactory(builder, sslContext);
 	}
 
 }

spring-cloud-netflix-eureka-client/src/main/java/org/springframework/cloud/netflix/eureka/http/WebClientTransportClientFactory.java

@@ -16,12 +16,17 @@
 
 package org.springframework.cloud.netflix.eureka.http;
 
+import java.util.Optional;
 import java.util.function.Supplier;
 
+import javax.net.ssl.SSLContext;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.netflix.discovery.shared.resolver.EurekaEndpoint;
 import com.netflix.discovery.shared.transport.EurekaHttpClient;
 import com.netflix.discovery.shared.transport.TransportClientFactory;
+import io.netty.handler.ssl.ClientAuth;
+import io.netty.handler.ssl.JdkSslContext;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.netty.http.client.HttpClient;
@@ -58,12 +63,20 @@ public class WebClientTransportClientFactory implements TransportClientFactory {
 
 	private final Supplier<WebClient.Builder> builderSupplier;
 
+	private final Optional<SSLContext> sslContext;
+
 	private final ConnectionProvider connectionProvider;
 
 	private final LoopResources loopResources;
 
 	public WebClientTransportClientFactory(Supplier<WebClient.Builder> builderSupplier) {
+		this(builderSupplier, Optional.empty());
+	}
+
+	public WebClientTransportClientFactory(Supplier<WebClient.Builder> builderSupplier,
+			Optional<SSLContext> sslContext) {
 		this.builderSupplier = builderSupplier;
+		this.sslContext = sslContext;
 		this.connectionProvider = ConnectionProvider.create("eureka-webclient");
 		this.loopResources = LoopResources.create("eureka-webclient");
 	}
@@ -78,8 +91,14 @@ public EurekaHttpClient newClient(EurekaEndpoint endpoint) {
 		// Use dedicated Reactor Netty resources independent of the reactive web server
 		// to prevent RejectedExecutionException during graceful shutdown when the
 		// server's event loop terminates before DiscoveryClient deregisters.
-		builder.clientConnector(
-				new ReactorClientHttpConnector(HttpClient.create(this.connectionProvider).runOn(this.loopResources)));
+		HttpClient httpClient = HttpClient.create(this.connectionProvider).runOn(this.loopResources);
+
+		if (this.sslContext.isPresent()) {
+			httpClient = httpClient.secure(sslContextSpec -> sslContextSpec
+				.sslContext(new JdkSslContext(this.sslContext.get(), true, ClientAuth.NONE)));
+		}
+
+		builder.clientConnector(new ReactorClientHttpConnector(httpClient));
 		return new WebClientEurekaHttpClient(builder.build());
 	}