FileWatcher used for SSL reload does not support symlinks

[tmaciejewski]

This allows using symlinks for SSL certificate hot reloading.

In my company we have services on k8s with SSL certificates stored on a mounted volumes. Since they are symlinks, we cannot use hot-reloading, because the content is changed in the file under the symlink, not the symlink itself. This change make FileWatcher watch not only the symlink, but also the file it resolves to.

[pivotal-cla]

@tmaciejewski Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-cla]

@tmaciejewski Thank you for signing the Contributor License Agreement!

[snicoll]

Thanks for the PR. This looks good but I am wondering about something and added a question.

[snicoll]

What is the reason for adding the symlink to the files to watch. Shouldn't we only add the real file?

[tmaciejewski]

Thanks for the review. Yeah, you're right. I wanted to keep backward compatibility, but since the real file is watched, it would still be there if the link is changed to some other file, which is less intuitive. Changed it to watch only the real file.

[snicoll]

@tmaciejewski thank you for making your first contribution to Spring Boot.

[PetarDimitrovZH]

Hi Everyone!

Is this released? I have the same or similar issue. I use kubernetes cert manager in order to manage my certs. It stores those as sym links:

drwxr-xr-x 2 maniax maniax 4096 Feb 18 10:58 ..data
lrwxrwxrwx 1 maniax maniax   19 Feb 18 10:59 keystore.p12 -> ..data/keystore.p12
lrwxrwxrwx 1 maniax maniax   21 Feb 18 11:00 truststore.p12 -> ..data/truststore.p12

ssl config:

spring:
  application:
    name: "shell"
  ssl:
    bundle:
      jks:
        shell:
          reload-on-update: false
          keystore:
            location: ${KEYSTORE:file:/opt/certs/keystore.p12}
            password: ${KEYSTORE_PW:changeit}
            type: "PKCS12"
          truststore:
            location: ${TRUSTSTORE:file:/opt/certs/truststore.p12}
            password: ${TRUSTSTORE_PW:changeit}
            type: "PKCS12"

But somehow spring cannot resolve them and I got this exception:

Caused by: java.lang.IllegalStateException: Unable to watch for reload on update
	at org.springframework.boot.autoconfigure.ssl.SslPropertiesBundleRegistrar.watchForUpdates(SslPropertiesBundleRegistrar.java:85) ~[spring-boot-autoconfigure-3.4.2.jar:3.4.2]
	at org.springframework.boot.autoconfigure.ssl.SslPropertiesBundleRegistrar.lambda$registerBundles$2(SslPropertiesBundleRegistrar.java:70) ~[spring-boot-autoconfigure-3.4.2.jar:3.4.2]
	... 74 common frames omitted
Caused by: java.io.UncheckedIOException: Failed to register paths for watching: [/opt/certs/keystore.p12, /opt/certs/truststore.p12]
	at org.springframework.boot.autoconfigure.ssl.FileWatcher.watch(FileWatcher.java:96) ~[spring-boot-autoconfigure-3.4.2.jar:3.4.2]
	at org.springframework.boot.autoconfigure.ssl.SslPropertiesBundleRegistrar.watchForUpdates(SslPropertiesBundleRegistrar.java:82) ~[spring-boot-autoconfigure-3.4.2.jar:3.4.2]
	... 75 common frames omitted
Caused by: java.io.IOException: '/home/maniax/projects/am-hub/..data/keystpre.p12' is neither a file nor a directory
	at org.springframework.boot.autoconfigure.ssl.FileWatcher$WatcherThread.register(FileWatcher.java:150) ~[spring-boot-autoconfigure-3.4.2.jar:3.4.2]
	at org.springframework.boot.autoconfigure.ssl.FileWatcher.watch(FileWatcher.java:93) ~[spring-boot-autoconfigure-3.4.2.jar:3.4.2]
	... 76 common frames omitted

---

**The problem is in the FileWatcher class witch resolves the file wrong and add the wrong absolute path to the resolved file. I my case int should prepend /opt/certs. The corect path is /opt/certs/..data/keystore.p12

The logs are from my local machine but in a kubernetes cluster I got the same result, just the path prefix is the path where the jar file executed.**

Can anyone help?

[bclozel]

@PetarDimitrovZH See #43966 which will be released this week.

[PetarDimitrovZH]

@bclozel Thank you!