Support for Hot TLS Certificate Rotation

[ukasus]

The following changes were made:

• Introduced ReloadableX509KeyManager and ReloadableX509TrustManager to wrap the dynamic gRPC SSL managers.
• Added 'GrpcServerSslManagerResolver' to resolve the reloadable managers from sslBundles and bind them to the addBundleUpdateHandler handler.
• Using set injection for setting managers in defaultGrpcServerFactory for all server factories.

Signed-off-by: Ujjawal Sharma ujjawal98kaushik@gmail.com

[resolves spring-projects/spring-boot#49833]

[dsyer]

Thanks for the patch. It seems grpc-java doesn't support live SSL context reload the way that Tomcat and Jetty do, so it would be good if they were to change that, but I'm not holding my breath. Consequently I see why you have to introduce reloadable extensions of KeyManager and TrustManager. What I don't really understand is why you can't just inject those directly into the credentials in the GrpcServerFactory (there's no need in that case for all the extra @Beans in this patch, or the levels in between there and the server factory). I suspect, if you have one, your AI friend has been over enthusiastic, and might need to be prompted a bit to reduce the amount of clutter in this new code.

[ukasus]

Thanks @dsyer for your valuable time and feedback, refactored the code as per your inputs.

[onobc]

Let's wait until #234 is merged into Spring Boot to push this through as the auto-configuration will go away in 1.1 once it moves to Spring Boot (i.e. this will be a PR in Spring Boot).

[spencergibb]

Watch spring-projects/spring-boot#49043

[philwebb]

Given the SSL code has now moved to Spring Boot I don't think we can easily migrate this PR, I'm going to close this one. Thanks anyway @ukasus!

If we try again in Boot, I'm not sure that we want to adopt the ReloadableX509...Manager code. Although it looks like it might work on the surface, I think there's a danger that it will cause issues if the actual underlying server isn't expecting reloads.

I'm pretty sure in Tomcat there's some logic to ensure that rotated certs are only adopted for new connections, and connections that are already established continue to work as they are.