Support trusting Aspire-mapped ASP.NET Core dev certs by TimHess · Pull Request #52 · SteeltoeOSS/Dockerfiles

TimHess · 2026-01-09T22:59:44Z

Bump to Spring Boot 3.5.10
Update versions recommended in readmes
Fix metadata in Eureka/SCCS
Add support for bidirectional https with dev certs from .NET/Aspire in SBA

Reduces the need for #40

Copilot

Pull request overview

Updates the local-dev Spring-based container images to newer Spring Boot versions and adds a shared mechanism to trust Aspire/.NET development certificates (notably for Spring Boot Admin).

Changes:

Bump Spring Boot version metadata to 3.5.10 across images.
Add Spring Boot Admin configuration patches for Steeltoe actuator compatibility and SSL trust via a custom ClientHttpConnector.
Introduce shared SSL trust configuration and update the build script to apply patches more robustly and copy shared SSL sources.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
uaa-server/README.md	Updates UAA image tag and documentation links.
spring-boot-admin/patches/steeltoe-admin-config.patch	Adds SBA WebClient customization to tolerate Steeltoe actuator index responses in AOT.
spring-boot-admin/patches/spring-boot-admin-ssl-config.patch	Adds SBA `ClientHttpConnector` bean wired to a shared `X509TrustManager`.
spring-boot-admin/patches/enable-springbootadmin.patch	Enables SBA server and expands component scanning/imports needed for SSL + Steeltoe config.
spring-boot-admin/patches/build.gradle.patch	Adjusts build-image environment settings (incl. native image build args).
spring-boot-admin/patches/application.properties.patch	Sets SBA defaults and configures SSL package logging.
spring-boot-admin/metadata/SPRING_BOOT_VERSION	Bumps Spring Boot version metadata to 3.5.10.
spring-boot-admin/metadata/IMAGE_VERSION	Bumps SBA image version metadata.
spring-boot-admin/README.md	Updates SBA run instructions/tag.
shared/ssl-config/SslTrustConfiguration.java	Adds shared trust manager that loads dev certs from standard locations/env vars.
eureka-server/patches/application.properties.patch	Adds Eureka properties and enables SSL package logging.
eureka-server/metadata/SPRING_BOOT_VERSION	Bumps Spring Boot version metadata to 3.5.10.
eureka-server/metadata/IMAGE_REVISION	Introduces image revision metadata.
eureka-server/README.md	Updates Eureka run instructions/tag.
config-server/patches/enableconfigserver.patch	Updates Config Server bootstrap (enables config server/discovery + logs package info).
config-server/patches/application.properties.patch	Adds Config Server properties and enables SSL package logging.
config-server/metadata/SPRING_BOOT_VERSION	Bumps Spring Boot version metadata to 3.5.10.
config-server/metadata/IMAGE_VERSION	Bumps Config Server image version metadata.
config-server/metadata/IMAGE_REVISION	Changes revision metadata content.
config-server/README.md	Updates Config Server run instructions/tags.
build.ps1	Enhances patch application behavior and copies shared SSL config into generated projects.
AGENTS.md	Adds agent guidance for patch handling/build workflow.
.gitattributes	Enforces LF endings for `.patch` files.

Comments suppressed due to low confidence (1)

config-server/patches/enableconfigserver.patch:24

This patch appears to truncate ConfigServer.java and does not include the closing braces for the main method and class. When applied, it will likely produce invalid Java and fail compilation. Please update the patch so the resulting file still ends with the appropriate } braces (and include the necessary context lines so patch can apply cleanly).

 	public static void main(String[] args) {
+        Package pkg = EnableConfigServer.class.getPackage();
+        logger.info("{} {} by {}", pkg.getImplementationTitle(), pkg.getImplementationVersion(), pkg.getImplementationVendor());
 		SpringApplication.run(ConfigServer.class, args);

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

eureka-server/patches/application.properties.patch

build.ps1

config-server/metadata/IMAGE_REVISION

build.ps1

shared/ssl-config/SslTrustConfiguration.java

Copilot · 2026-01-28T19:15:45Z

@TimHess I've opened a new pull request, #53, to work on those changes. Once the pull request is ready, I'll request review from you.

github-actions · 2026-01-28T21:18:48Z

To run the UAA server image built for this pull request:

docker run --rm -d --pull=always -p 8080:8080 --name uaa-pr steeltoe.azurecr.io/uaa-server:pr-52

github-actions · 2026-01-28T21:20:05Z

To run the Eureka server image built for this pull request:

docker run --rm -d --pull=always -p 8761:8761 --name eureka-pr steeltoe.azurecr.io/eureka-server:pr-52

github-actions · 2026-01-28T21:20:05Z

To run the Spring Cloud Config Server image built for this pull request:

docker run --rm -d --pull=always -p 8888:8888 --name config-pr steeltoe.azurecr.io/config-server:pr-52

github-actions · 2026-01-28T21:23:01Z

To run the Spring Boot Admin server image built for this pull request:

docker run --rm -d --pull=always -p 9099:9099 --name sba-pr steeltoe.azurecr.io/spring-boot-admin:pr-52

Copilot

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 8 comments.

Comments suppressed due to low confidence (1)

config-server/patches/application.properties.patch:15

This logging category likely won't affect the shared trust configuration at runtime. build.ps1 copies shared/ssl-config/SslTrustConfiguration.java into the app's base package and rewrites its package declaration to io.steeltoe.docker.<serverName> (build.ps1:300-315), so the logger name won’t be under io.steeltoe.docker.ssl. Consider switching this to logging.level.io.steeltoe.docker=INFO or the concrete app package so the SSL trust logs can actually be controlled.

+auth.enabled=false
+logging.level.io.steeltoe.docker.ssl=INFO

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

shared/ssl-config/SslTrustConfiguration.java

.github/workflows/build_uaa_server.yaml

.github/workflows/build_config_server.yaml

AGENTS.md

eureka-server/patches/application.properties.patch

spring-boot-admin/patches/steeltoe-admin-config.patch

.github/workflows/build_springboot_admin_server.yaml

.github/workflows/build_eureka_server.yaml

- Log dependencies requested in calls to start.spring.io - Enhance patch handling to catch more failure scenarios - Use eol=lf for .patch files - fix enableconfigserver.patch

- add custom deserialization for aot/native-compiled SBA to avoid breakage over 'type' property in Steeltoe responses fixup metadata skip self-replication in Eureka

* Update eureka-server/patches/application.properties.patch * Fix line count in patch * Update build.ps1 to trim/join IMAGE_REVISION and check for non-empty * Use cryptographic signature verification in SslTrustConfiguration --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: TimHess <3947063+TimHess@users.noreply.github.com>

- Fix logging.level namespace to match actual package after build-time rewriting (io.steeltoe.docker instead of io.steeltoe.docker.ssl) - Correct AGENTS.md patch documentation for unified diff hunk headers

bart-vmware · 2026-02-06T13:31:01Z

spring-boot-admin/patches/enable-springbootadmin.patch

+
 +@EnableAdminServer
+@Import(SteeltoeAdminConfiguration.class)
+ @SpringBootApplication


Can we keep this file as similar as possible to the original version, or does the order of @-lines matter? Also, regarding the added blank lines.

Changing the order was a troubleshooting step when something was going wrong, but I don't think it had an impact either way and I just didn't revert the change. The rest of the changes were to appease patch, presumably due to upstream changes on the initializr. I'll put it back as close as I can.

@SpringBootApplication and @EnableAdminServer are still swapped.

bart-vmware · 2026-02-06T13:34:12Z

spring-boot-admin/patches/build.gradle.patch

 +    environment = [
-+       "BP_SPRING_CLOUD_BINDINGS_DISABLED": "true"
+       "BP_SPRING_CLOUD_BINDINGS_DISABLED": "true",
+       "BP_NATIVE_IMAGE_BUILD_ARGUMENTS": "-H:+UnlockExperimentalVMOptions"


According to https://answers.ycrash.io/question/what-is-unlock-experimental-vm-options--xxunlockexperimentalvmoptions?q=702:

The -XX:+UnlockExperimentalVMOptions flag unlocks experimental JVM features. These features may be unstable and are therefore not available by default, so this flag is required to make them available.
Using experimental features enabled by this flag is not encouraged in a production system. They may crash or cause unexpected behaviour. Also the JVM vendor will not provide support for experimental features.

Do we really need this?

I added UnlockExperimentalVMOptions to avoid this build log entry:

[creator] 1 experimental option(s) unlocked: [creator] - '-H:Name' (alternative API option(s): -o io.steeltoe.docker.springbootadmin.SpringBootAdmin; origin(s): command line)

We could remove it and just ignore the warning. Here's an explanation of what that does:

The -H:Name is being passed by the Paketo native-image buildpack itself, not by us. When it builds the native image, it automatically sets -H:Name=/layers/.../io.steeltoe.docker.springbootadmin.SpringBootAdmin based on the Spring Boot main class. We can't easily override this - it's internal to the buildpack. The UnlockExperimentalVMOptions is the correct workaround until Paketo updates their buildpack to use the non-experimental -o syntax.

I think it would be safer not to enable experimental features unless they negatively affect our usage beyond the warning.

bart-vmware · 2026-02-06T13:40:12Z

config-server/README.md


 ```shell
-docker run --publish 8888:8888 steeltoe.azurecr.io/config-server
+docker run --publish 8888:8888 steeltoe.azurecr.io/config-server:4


Why were version numbers added in this and other README files?

Previously UAA was specifying the latest version number tag, but that was out of date... I updated all of them to use the latest version number, but it would be lower maintenance to just remove the tag and rely on latest

The README for Config Server still has a version number.

bart-vmware · 2026-02-06T13:43:10Z

spring-boot-admin/patches/ssl-trust-config.patch

+ *   <li>{@code SSL_CERT_FILE} environment variable (single certificate file)</li>
+ * </ul>
+ *
+ * <p>Supported certificate formats: .pem, .crt, .cer


Do these <p> tags need a companion closing tag?

Debatable whether it matters at the moment, but I'll close them so we're better prepped for the next iteration of building these images

I would expect the list to be part of the paragraph:

spring-boot-admin/patches/ssl-trust-config.patch

spring-boot-admin/patches/steeltoe-admin-config.patch

uaa-server/README.md

AGENTS.md

- drop tags from readmes - remove hardcoded aspire cert paths, fix env dir list parsing - fix broken-again link - sync agents.md

…rt times)

bart-vmware · 2026-02-06T20:05:23Z

config-server/patches/build.gradle.patch

 +    environment = [
-+       "BP_SPRING_CLOUD_BINDINGS_DISABLED": "true"
+       "BP_SPRING_CLOUD_BINDINGS_DISABLED": "true",
+       "BP_JVM_CDS_ENABLED": "true"


According to https://github.com/paketo-buildpacks/spring-boot, BP_JVM_CDS_ENABLED is deprecated in favor of BPL_JVM_AOTCACHE_ENABLED.

Should this be added to SBA as well?

These flags don't apply to native-compiled apps. I'll go back and try SBA without native comp and with these flags and see if that gets us out of needing the custom deserializer

Should this be added to SBA as well?

This question led me to #58. It wouldn't do anything for a native image, but is probably ultimately a better solution for us as doesn't require most of the custom code that's currently in this PR

bart-vmware · 2026-02-06T20:10:29Z

spring-boot-admin/patches/enable-springbootadmin.patch

+
 +@EnableAdminServer
+@Import(SteeltoeAdminConfiguration.class)
+ @SpringBootApplication


@SpringBootApplication and @EnableAdminServer are still swapped.

bart-vmware · 2026-02-06T20:15:56Z

spring-boot-admin/patches/build.gradle.patch

 +    environment = [
-+       "BP_SPRING_CLOUD_BINDINGS_DISABLED": "true"
+       "BP_SPRING_CLOUD_BINDINGS_DISABLED": "true",
+       "BP_NATIVE_IMAGE_BUILD_ARGUMENTS": "-H:+UnlockExperimentalVMOptions"


I think it would be safer not to enable experimental features unless they negatively affect our usage beyond the warning.

bart-vmware · 2026-02-06T20:16:55Z

config-server/README.md


 ```shell
-docker run --publish 8888:8888 steeltoe.azurecr.io/config-server
+docker run --publish 8888:8888 steeltoe.azurecr.io/config-server:4


The README for Config Server still has a version number.

bart-vmware · 2026-02-06T20:17:40Z

spring-boot-admin/patches/ssl-trust-config.patch

+ *   <li>{@code SSL_CERT_FILE} environment variable (single certificate file)</li>
+ * </ul>
+ *
+ * <p>Supported certificate formats: .pem, .crt, .cer


I would expect the list to be part of the paragraph:

bart-vmware · 2026-02-06T20:21:12Z

spring-boot-admin/patches/ssl-trust-config.patch

+            if (trustManagers == null || trustManagers.length == 0 || !(trustManagers[0] instanceof X509TrustManager)) {
+                throw new IllegalStateException("No X509TrustManager available from default TrustManagerFactory");
+            }
+            X509TrustManager defaultTrustManager = (X509TrustManager) trustManagers[0];


Sounds like we should throw for multiple. Better to fail than to silently continue without anyone noticing. If the exception ever pops up, we'll have to find a better way.

- remove last tag from readme - un-reorder lines for sba

SteeltoeOSS deleted a comment from github-actions bot Jan 27, 2026

TimHess force-pushed the https branch from ea17323 to ca56eb3 Compare January 27, 2026 23:13

SteeltoeOSS deleted a comment from github-actions bot Jan 28, 2026

TimHess marked this pull request as ready for review January 28, 2026 00:57

Copilot AI review requested due to automatic review settings January 28, 2026 00:57

Copilot started reviewing on behalf of TimHess January 28, 2026 00:57 View session

TimHess requested a review from bart-vmware January 28, 2026 00:57

Copilot AI reviewed Jan 28, 2026

View reviewed changes

Copilot AI mentioned this pull request Jan 28, 2026

Address feedback: fix IMAGE_REVISION handling and improve SSL certificate validation #53

Merged

SteeltoeOSS deleted a comment from github-actions bot Jan 28, 2026

TimHess force-pushed the https branch from f41dc14 to 3560bce Compare January 28, 2026 21:18

SteeltoeOSS deleted a comment from github-actions bot Jan 28, 2026

TimHess requested a review from Copilot January 28, 2026 21:35

Copilot started reviewing on behalf of TimHess January 28, 2026 21:36 View session

Copilot AI reviewed Jan 28, 2026

View reviewed changes

TimHess and others added 3 commits January 29, 2026 10:06

bump to Spring Boot 3.5.10, update READMEs, add AGENTS.md

28fae7f

- Log dependencies requested in calls to start.spring.io - Enhance patch handling to catch more failure scenarios - Use eol=lf for .patch files - fix enableconfigserver.patch

Support trusting Aspire dev certs

e4493ac

- add custom deserialization for aot/native-compiled SBA to avoid breakage over 'type' property in Steeltoe responses fixup metadata skip self-replication in Eureka

TimHess force-pushed the https branch from 3560bce to 5ce7172 Compare January 29, 2026 16:06

TimHess added 3 commits January 29, 2026 17:31

Address PR review feedback

58d5ae6

- Fix logging.level namespace to match actual package after build-time rewriting (io.steeltoe.docker instead of io.steeltoe.docker.ssl) - Correct AGENTS.md patch documentation for unified diff hunk headers

update default docker org

01cfbdf

limit ssl-related changes to SBA

eff495c

TimHess changed the title ~~Support trusting Aspire dev certs~~ Support trusting Aspire-mapped ASP.NET Core dev certs Feb 5, 2026

apply patches with "git apply" instead of "patch"

8c58e1c

bart-vmware reviewed Feb 6, 2026

View reviewed changes

pr feedback

88b49e7

- drop tags from readmes - remove hardcoded aspire cert paths, fix env dir list parsing - fix broken-again link - sync agents.md

TimHess requested a review from bart-vmware February 6, 2026 16:51

enable class data sharing for non-native images (.5 second faster sta…

2956bc1

…rt times)

bart-vmware reviewed Feb 6, 2026

View reviewed changes

BP_JVM_CDS_ENABLED => BP_JVM_AOTCACHE_ENABLED

8c9534c

- remove last tag from readme - un-reorder lines for sba

TimHess force-pushed the https branch from ce1d811 to 8c9534c Compare February 7, 2026 01:57

TimHess mentioned this pull request Feb 7, 2026

[Overlaps with #52] Switch Spring Boot Admin from Native to AOT #58

Draft

Conversation

TimHess commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TimHess Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TimHess commented Jan 9, 2026 •

edited

Loading

TimHess Feb 6, 2026 •

edited

Loading