feat(cassandra): add ssl option cassandra #3151

MitulShah1 · 2025-05-02T09:35:59Z

What does this PR do?

Why is it important?

Related issues

@mdelapenya Can you please review

netlify · 2025-05-02T09:36:18Z

✅ Deploy Preview for testcontainers-go ready!

Name	Link
🔨 Latest commit	`60622d4`
🔍 Latest deploy log	https://app.netlify.com/sites/testcontainers-go/deploys/681d95cdea7398000823931c
😎 Deploy Preview	https://deploy-preview-3151--testcontainers-go.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

…dd-ssl-option-cassandra

# Conflicts: # go.sum

mdelapenya

Looking good, although I added some comments about using the same approach as in the Redis module. Could you please take a look?

Cheers!

mdelapenya · 2025-05-07T02:55:34Z

modules/cassandra/cassandra.go

 		),
 	}

+	c := &CassandraContainer{}


suggestion: keep this initialisation next to its usage. Seems moved here for no reasons

mdelapenya · 2025-05-07T02:56:02Z

modules/cassandra/cassandra.go

 		},
 		WaitingFor: wait.ForAll(
 			wait.ForListeningPort(port),
 			wait.ForExec([]string{"cqlsh", "-e", "SELECT bootstrapped FROM system.local"}).WithResponseMatcher(func(body io.Reader) bool {
 				data, _ := io.ReadAll(body)
 				return strings.Contains(string(data), "COMPLETED")
-			}),
+			}).WithStartupTimeout(2*time.Minute),


question: is 2 minutes too long? Can we use a shorter duration?

mdelapenya · 2025-05-07T02:57:05Z

modules/cassandra/cassandra.go

+			"CASSANDRA_SKIP_WAIT_FOR_GOSSIP":   "1",
+			"CASSANDRA_START_NATIVE_TRANSPORT": "true",


question: are these new env vars related to the SSL options? If not, I'd separate the changes into a new PR, if possible

mdelapenya · 2025-05-07T02:58:45Z

modules/cassandra/cassandra.go

+}
+
+// WithTLS is an alias for WithSSL for user convenience
+func WithTLS(opts SSLOptions) testcontainers.CustomizeRequestOption {


question: why adding two flavours of the same option? I'd just choose one to avoid creating confusion on users

mdelapenya · 2025-05-07T03:01:32Z

modules/cassandra/cassandra.go

+		}
+
+		// Mark that SSL is enabled for later use
+		req.Labels = mergeMap(req.Labels, map[string]string{"testcontainers.cassandra.ssl": "true"})


question: I guess this is needed to notify the Run function about the SSL addition, right? I'd choose a different pattern for this, creating an options type as in the redis module. Then, you can simply generate the SSL certs on-the-fly as in that module.

MitulShah1 · 2025-05-07T07:08:09Z

Looking good, although I added some comments about using the same approach as in the Redis module. Could you please take a look?

Cheers!

I made changes, can you please check again?

stevenh

Thanks for the quick updates, here's some suggestion which focus on simplification and reducing API surface area.

stevenh · 2025-05-07T08:48:27Z

modules/cassandra/options.go

+	IsTLSEnabled bool
+	TLSConfig    *tls.Config


suggestion: make these private so there's less API surface area allowing for refactoring without causing breaking changes. Given it's typed nature we can skip the Is prefix for boolean flag too.

Suggested change

IsTLSEnabled bool

TLSConfig *tls.Config

tlsEnabled bool

tlsConfig *tls.Config

More fixes to align with this change obviously, so best to just rename in your editor.

stevenh · 2025-05-07T08:51:33Z

modules/cassandra/options.go

+// GenerateJKSKeystore generates a JKS keystore with a self-signed cert using keytool, and extracts the public cert for Go client trust.
+func GenerateJKSKeystore() (keystorePath, certPath string, err error) {


suggestion: make private, again less API surface area to maintain. Also needs to use go not an external tool which might not be present on all platforms. See other modules on how they generate keys, hopefully that's compatible with cassandra.

@stevenh making this function private, i need to change in options_test.go, its ok?

Either that or make a seperate test file.

options_test.go is created by me only but i cannot access that function as testcases are depend on it, do you want me to make this function private and remove options_test.go?

Up to you, having integration and unit tests are both good. In go its not a problem to use the main package for tests, as long as you're conscious about the seperation.

However can we should first see if we can eliminate this external dependency. You can see a similar example here: https://github.com/testcontainers/testcontainers-go/blob/main/modules/redis/options.go#L86 which uses https://pkg.go.dev/github.com/mdelapenya/tlscert

It seems you're suggesting we either minimize SSL-related dependencies or simply support SSL with minimal setup. I always try to follow the existing repository codebase and coding style as much possible.

Initially, I tried using only tlscert, but it has some limitations. If we choose to use tlscert, we can eliminate the keytool dependency, but we'd then need to rely on openssl.

So, we have two options:

Use keytool as we currently do.

Follow an approach similar to Cassandra's Go driver, where certificates are added in a testdata folder and used for SSL testing, as seen in the official Go driver.

tlscert would be the preferred option as it's what a lot of the other modules use.

If it needs changes that should be quick and easy as that module is written by @mdelapenya one of this repositories maintainers.

i know but it can handle this cassandra cert generation? @mdelapenya ? i already tried that let me know if ok to use openssl then i will make change to tlscert.

Yes, let's use it for consistency. If there is a missing feature in that library, let's open an issue in there and work on fix and release it

Cheers!

A Quick Look and it seems like it can use standard pen formatted certs so it should just work

modules/cassandra/cassandra.go

modules/cassandra/options.go

stevenh

A few bugs introduced here I think, the big question is eliminating the use of external dependency keytool

stevenh · 2025-05-07T12:01:44Z

modules/cassandra/options.go

+// GenerateJKSKeystore generates a JKS keystore with a self-signed cert using keytool, and extracts the public cert for Go client trust.
+func GenerateJKSKeystore() (keystorePath, certPath string, err error) {


Up to you, having integration and unit tests are both good. In go its not a problem to use the main package for tests, as long as you're conscious about the seperation.

However can we should first see if we can eliminate this external dependency. You can see a similar example here: https://github.com/testcontainers/testcontainers-go/blob/main/modules/redis/options.go#L86 which uses https://pkg.go.dev/github.com/mdelapenya/tlscert

stevenh · 2025-05-07T12:03:05Z

modules/cassandra/cassandra.go

@@ -14,28 +16,35 @@ import (
 )

 const (
-	port = nat.Port("9042/tcp")
+	port       = nat.Port("9042/tcp")
+	securePort = nat.Port("9142/tcp") // Common port for SSL/TLS connections


question: do we need to two ports or can it just be one which is either SSL or not?

stevenh · 2025-05-07T12:07:50Z

modules/cassandra/cassandra.go

+	waitStrategies := []wait.Strategy{
+		wait.ForListeningPort(port),
+		wait.ForExec([]string{"cqlsh", "-e", "SELECT bootstrapped FROM system.local"}).WithResponseMatcher(func(body io.Reader) bool {
+			data, _ := io.ReadAll(body)
+			return strings.Contains(string(data), "COMPLETED")
+		}).WithStartupTimeout(1 * time.Minute),
+	}


@mdelapenya looks like we have an issue with WithWaitStrategy, it sets vs appending to WaitFor preventing easy initialisation here.

Indeed. I think the use case here would be appending. I can submit a fix now

stevenh · 2025-05-07T12:09:37Z

modules/cassandra/cassandra.go

+
+	// Apply wait strategy using the correct method
+	if err := testcontainers.WithWaitStrategy(wait.ForAll(waitStrategies...)).Customize(&genericContainerReq); err != nil {
+		return nil, err


suggestion: wrap the error here

Suggested change

return nil, err

return nil, fmt.Errorf("with wait strategy: %w", err)

stevenh · 2025-05-07T12:10:47Z

modules/cassandra/cassandra.go

+// TLSConfig returns the TLS configuration for the Cassandra container, nil if TLS is not enabled.
+func (c *CassandraContainer) TLSConfig() *tls.Config {


@mdelapenya quite a common pattern in modules, we should consider returning an error instead.

You mean the pointer to the config and the error, right? I think we changed the tlscert library precisely for that, so good to me to change it

Nope, these container methods, have them return an error if the config is nil vs just returning nil as the caller should know if they enabled TLS or not.

func (c *CassandraContainer) TLSConfig() (*tls.Config, error) { if c.settings.tlsConfig == nil { return nil, errors.New("tls not enabled") } return c.settings.tlsConfig.Config, nil }

Oh I see, the recently added methods for Redis and Valkey. For Valkey, we are in the same release cycle, we can change it without BC, for Redis, it's a BC

stevenh · 2025-05-07T12:13:30Z

modules/cassandra/options.go

+func (o Option) Customize(req *testcontainers.GenericContainerRequest) error {
+	return o(req, &Options{})


bug: while this will run there options won't be accessible, so should still be just a noop.

We're looking to refactor how this works in a future version to avoid this, but that will be a bit.

stevenh · 2025-05-07T12:15:06Z

modules/cassandra/cassandra.go

 	}

 	genericContainerReq := testcontainers.GenericContainerRequest{
 		ContainerRequest: req,
 		Started:          true,
 	}

+	var settings Options


bug: settings is never set, you still need to check if you have an Option in the for loop and process it to ensure it set correctly.

If your tests are passing they shouldn't so might need a fix there too.

stevenh · 2025-05-07T12:16:54Z

modules/cassandra/options.go

+// TLSConfig represents the TLS configuration for Cassandra
+type TLSConfig struct {


question: are the paths needed? If not we can just return *tls.Config. I suspect the answer is dependent on eliminating the need for keytool

MitulShah1 added 6 commits May 1, 2025 16:41

Added SSL Option

ba9ac99

Passed tests

a87e16b

Implemented SSL Support

d7c7be5

Implemented SSL Support

22c2887

Implemented SSL Support

dfe89e6

Merge branch 'main' into add-ssl-option-cassandra

59a1733

MitulShah1 requested a review from a team as a code owner May 2, 2025 09:36

MitulShah1 added 7 commits May 2, 2025 15:16

Merge branch 'main' into add-ssl-option-cassandra

4e7b372

Merge remote-tracking branch 'origin/add-ssl-option-cassandra' into a…

875e63f

…dd-ssl-option-cassandra

Revert go.mod and go.sum

8e1b349

Revert go.mod and go.sum

26a38e1

Golint fix

7d76d50

Golint fix

cc1dd06

Govet fix

71100a9

MitulShah1 changed the title ~~Add ssl option cassandra~~ feat(cassandra): Add ssl option cassandra May 2, 2025

mdelapenya changed the title ~~feat(cassandra): Add ssl option cassandra~~ feat(cassandra): add ssl option cassandra May 3, 2025

Merge branch 'main' into add-ssl-option-cassandra

f07aea2

# Conflicts: # go.sum

mdelapenya requested changes May 7, 2025

View reviewed changes

MitulShah1 and others added 5 commits May 7, 2025 10:31

reduce wait time, revert container place and removed WithTLS options

ac19eb4

Added SSL With option

5b636f7

Merge branch 'main' into add-ssl-option-cassandra

2ad9f7b

Added SSL With option

7409635

Devide Run function n sub function to reduce complexity

4c2e3dc

MitulShah1 requested a review from mdelapenya May 7, 2025 07:05

stevenh requested changes May 7, 2025

View reviewed changes

MitulShah1 added 2 commits May 7, 2025 14:59

make Options private

6da1e1e

removed setupTls function and moved to WithSSL Options

9a4f4f2

github-advanced-security bot found potential problems May 7, 2025

View reviewed changes

modules/cassandra/options.go Fixed Show fixed Hide fixed

MitulShah1 added 2 commits May 7, 2025 15:25

Fix Sec warning InsecureSkipVerify

5242c32

Fix lint

18214a0

MitulShah1 requested a review from stevenh May 7, 2025 10:36

stevenh requested changes May 7, 2025

View reviewed changes

stevenh mentioned this pull request May 7, 2025

[Bug]: Permission denied reading redpanda.yaml stopping container from proper start #3157

Open

MitulShah1 added 2 commits May 9, 2025 11:00

Merge branch 'main' into add-ssl-option-cassandra

8ba3319

Merge branch 'main' into add-ssl-option-cassandra

60622d4

		"CASSANDRA_SKIP_WAIT_FOR_GOSSIP": "1",
		"CASSANDRA_START_NATIVE_TRANSPORT": "true",

		// GenerateJKSKeystore generates a JKS keystore with a self-signed cert using keytool, and extracts the public cert for Go client trust.
		func GenerateJKSKeystore() (keystorePath, certPath string, err error) {

	return nil, err
	return nil, fmt.Errorf("with wait strategy: %w", err)

		// TLSConfig returns the TLS configuration for the Cassandra container, nil if TLS is not enabled.
		func (c CassandraContainer) TLSConfig() tls.Config {

		func (o Option) Customize(req *testcontainers.GenericContainerRequest) error {
		return o(req, &Options{})

		// TLSConfig represents the TLS configuration for Cassandra
		type TLSConfig struct {

Uh oh!

feat(cassandra): add ssl option cassandra #3151

Are you sure you want to change the base?

feat(cassandra): add ssl option cassandra #3151

Uh oh!

Conversation

MitulShah1 commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Why is it important?

Related issues

Uh oh!

netlify bot commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for testcontainers-go ready!

Uh oh!

mdelapenya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MitulShah1 commented May 7, 2025

Uh oh!

stevenh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

stevenh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

MitulShah1 commented May 2, 2025 •

edited

Loading

netlify bot commented May 2, 2025 •

edited

Loading