WFLY-21473 Promote TLS support to JGroups TCP transport to default stability

In  clustering cloud openshift
Tracked by https://github.com/wildfly/wildfly-proposals/issues/808

Overview

This proposal promotes the "TLS support to JGroups TCP transport" feature from community stability to default stability. This feature was implemented in WFLY-15836 with the corresponding community proposal at wildfly-proposals#552.

For complete details on the feature’s design and implementation, refer to the original proposal.

User Stories

User wants to secure internal cluster TCP communication using TLS leveraging Elytron subsystem capabilities at default stability level.

Issue Metadata

Affected Projects or Components

Other Interested Projects

  • N/A

Relevant Installation Types

  • Traditional standalone server (unzipped or provisioned by Galleon)

  • Managed domain

  • OpenShift Source-to-Image (S2I)

  • Bootable jar

Requirements

All requirements from the original proposal remain in effect.

Changed requirements

Base requirements from the original proposal with changes such as:

The client-ssl-context and server-ssl-context attributes are now available only on the TCP transport resource. The TCP_NIO2 transport does not support TLS (see Non-Requirements).

The resource definition registrar is split into two:

  • SocketTransportResourceDefinitionRegistrar — base registrar for socket-based transports without TLS support (used by TCP_NIO2).

  • SecurableSocketTransportResourceDefinitionRegistrar — extends the base with client-ssl-context and server-ssl-context attributes (used by TCP).

When TLS is configured on the TCP transport and a protocol such as FD_SOCK2 requests a non-blocking NIO channel, the channel is created without TLS and a warning is logged. This is because TLS support for NIO channels is not available. Users who need encrypted failure detection should use TCP’s built-in failure detection (suspect events) or the socket-based FD_SOCK protocol.

Non-Requirements

  • TCP_NIO2 transport does not support TLS. The JDK does not provide native support for TLS-secured NIO channels, making a reliable production-grade implementation not feasible. TLS support for TCP_NIO2 is tracked as future work in WFLY-21665.

Future Work

Backwards Compatibility

There are no backwards compatibility concerns with promoting this feature. The feature remains opt-in and does not change the default configuration.

All backwards compatibility aspects from the original proposal remain in effect.

Default Configuration

The default configuration will not be changed. Users have to configure this explicitly.

All configuration aspects from the original proposal remain in effect.

Importing Existing Configuration

All configuration aspects from the original proposal remain in effect.

Deployments

All configuration aspects from the original proposal remain in effect.

Interoperability

All interoperability aspects from the original proposal remain in effect.

Implementation Plan

This feature will be promoted in a single PR to WildFly upstream repository. No further coordination is necessary.

Admin Clients

No changes required beyond what was done for the original implementation.

  • JBoss CLI doesn’t require changes as it supports everything natively.

  • HAL changes were tracked as HAL-2043 and are picked up automatically at a higher stability.

Security Considerations

No changes from the original proposal. The feature builds on verified security concepts and the attributes referencing the Elytron SSL contexts are marked as security sensitive.

Test Plan

All existing tests from the original implementation remain in place. These include management model unit tests and integration tests with both positive and negative test cases.

For promotion to default stability, the following additional validation has been performed:

  • Verification that all existing tests pass at the default stability level.

  • Manual verification of attribute descriptions and error messages for clarity.

  • Verification that the feature documentation is complete and accurate.

Test infrastructure has been significantly improved with per-node keystores (TLSServerSetupTask.PerNodeKeyStore) replacing the previous shared keystore approach, enabling proper mutual TLS authentication with per-node identity in tests.

Community Documentation

Documentation was included with the original implementation’s pull request and resides in the High Availability Guide.

It has been updated to clarify:

  • TLS is supported on the TCP transport only (not TCP_NIO2).

  • FD_SOCK2 failure detection traffic is not encrypted when using TLS-secured TCP, with recommended alternatives.

Release Note Content

The "TLS support to JGroups TCP transport" feature has been promoted to default stability level. This feature allows securing internal cluster TCP communication using TLS with references to Elytron SSL contexts. Note that TLS is supported on the TCP transport only; TCP_NIO2 does not support TLS. Please refer to the 'High Availability Guide' in the user documentation for more information.