spring-boot-starter-actor icon indicating copy to clipboard operation
spring-boot-starter-actor copied to clipboard
Published 2 months ago • verified publisher icon seonWKim

Implement security features: TLS/SSL configuration and task specifications

Open Copilot opened this issue 2 months ago • 0 comments

Description

Implements security infrastructure for production cluster deployments, focusing on TLS/SSL encryption for actor-to-actor communication. Creates comprehensive roadmap for authentication, authorization, audit logging, and rate limiting.

Changes Made

Task Specifications (roadmap/10-security/tasks/)

  • Phase 1 (TLS/SSL): Certificate configuration, rotation, and testing specifications
  • Phase 2 (Auth/Authz): Spring Security integration, RBAC, and configuration specs
  • Phase 3 (Audit): Audit logging with field masking and multiple destinations
  • Phase 4 (Rate Limiting): Per-user rate limiting (optional)
  • Phase 5 (Encryption): Message encryption (deferred)

TLS/SSL Implementation (core/src/main/java/.../security/tls/)

Configuration

  • TlsConfigurationProperties: Spring Boot YAML binding for keystore/truststore, protocols (TLSv1.2/1.3), cipher suites, mutual TLS
  • TlsAutoConfiguration: Auto-configuration with @ConditionalOnProperty for TLS enablement
  • Certificate rotation support (grace period, file watching)

Certificate Management

  • KeystoreManager: Loads JKS/PKCS12 keystores from classpath or filesystem, validates certificate chains, checks expiry
  • CertificateInfo: Certificate metadata (subject, issuer, validity period)
  • TlsConfigurationLogger: Security-conscious logging (masks sensitive paths, warns on expiring certificates)

Configuration Example

spring:
  actor:
    pekko:
      remote:
        artery:
          ssl:
            enabled: true
            key-store: classpath:keystore.jks
            key-store-password: ${KEYSTORE_PASSWORD}
            trust-store: classpath:truststore.jks
            trust-store-password: ${TRUSTSTORE_PASSWORD}
            protocol: TLSv1.3
            enabled-algorithms:
              - TLS_AES_256_GCM_SHA384
              - TLS_AES_128_GCM_SHA256

Additional Context

Foundation establishes secure-by-default configuration pattern. Certificate rotation, Kubernetes cert-manager integration, and comprehensive tests remain to be implemented per task specifications. All existing tests pass.

Original prompt

You are tasked with implementing security features for the spring-boot-starter-actor project.

REPOSITORY INFORMATION:

  • Branch: main (you MUST work on main branch)
  • Directory: roadmap/10-security/

PRIORITY: HIGH (TLS/SSL, Auth), MEDIUM (Others) EFFORT: 12 weeks

OBJECTIVE: Implement security features for production cluster deployments.

TASKS: Read all files in roadmap/10-security/ first.

PHASE 1 (Week 1-3): TLS/SSL for Cluster Communication - HIGH PRIORITY

  • Read tasks/01-tls-ssl-configuration.md for detailed specifications
  • Create Spring Boot YAML configuration for TLS/SSL settings
    • Keystore configuration
    • Truststore configuration
    • TLS protocol versions
    • Cipher suites
  • Implement keystore and truststore management
    • File-based keystores
    • Environment variable support for passwords
    • Validation of certificate chains
  • Read tasks/02-certificate-rotation.md
  • Implement certificate rotation support without cluster restart
    • File watching for certificate updates
    • Graceful rotation without downtime
    • Logging for rotation events
  • Integrate with Kubernetes cert-manager
    • Support for cert-manager certificates
    • Automatic certificate renewal
    • Documentation for Kubernetes setup
  • Read tasks/03-tls-testing.md
  • Write comprehensive tests for encrypted communication
    • Test cluster formation with TLS
    • Test certificate validation
    • Test certificate rotation
    • Test error scenarios (expired certs, invalid certs)
  • Create production setup guide
    • Step-by-step TLS configuration
    • Certificate generation instructions
    • Troubleshooting guide
    • Best practices for production

PHASE 2 (Week 4-9): Authentication & Authorization

  • Read tasks/04-spring-security-integration.md for detailed specifications
  • Integrate with Spring Security framework
    • Security context propagation to actors
    • Integration with Spring Security filters
    • Support for various authentication mechanisms
  • Create @Secured annotation support for actors
    • Method-level security for actor message handlers
    • Role-based access control
    • Integration with Spring Security's @Secured
  • Implement security context propagation across actor calls
    • Maintain security context across async boundaries
    • Propagate authentication information
    • Support for custom security contexts
  • Read tasks/05-rbac-implementation.md
  • Implement role-based access control (RBAC)
    • Per-actor authorization rules
    • Permission checking before message processing
    • Configurable role hierarchies
    • Default deny policy
  • Create permission checking infrastructure
    • Pre-processing hooks for authorization
    • Audit logging for authorization decisions
    • Clear error messages for authorization failures
  • Read tasks/06-auth-configuration.md
  • Implement Spring Boot YAML configuration for auth/authz
    • Per-actor security rules
    • Role mappings
    • Permission definitions
  • Write comprehensive security tests
    • Test authentication propagation
    • Test authorization decisions
    • Test security violations
    • Test role hierarchies

PHASE 3 (Week 10-11): Audit Logging

  • Read tasks/07-audit-logging.md for detailed specifications
  • Create @Audited annotation for automatic audit trails
    • Annotate actors or message handlers for auditing
    • Capture message type, sender, timestamp
    • Capture actor state changes
    • Support for custom audit fields
  • Implement field masking for sensitive data
    • Automatic masking of password fields
    • Configurable masking patterns
    • Support for custom masking strategies
    • Ensure sensitive data never appears in audit logs
  • Read tasks/08-audit-destinations.md
  • Implement multiple audit destinations
    • Database destination (via Spring Data)
    • Kafka destination (async streaming)
    • File destination (local or network)
    • Configurable routing (which events to which destinations)
  • Create query API for audit logs
    • Search by actor, message type, time range
    • Filtering and pagination
    • Export functionality
  • Write comprehensive tests for audit logging
  • Create documentation for compliance use cases

PHASE 4 (Week 12, Optional): Rate Limiting

  • Read tasks/10-rate-limiting.md for detailed specifications
  • Implement per-user rate limiting
    • Extract user identity from security context
    • Configurable limits per user or role
    • Integration with existing throttling infrastructure
  • Create Spring Boot configuration for rate limits
  • Implement metrics for rate limiting
  • Write comprehensive tests
  • This phase is OPTIONAL - only implement if time permits

PHASE 5 (Deferred): Message Encryption

  • Read tasks/09-message-encryption.md
  • This phase is DEFERRED (LOW priority - niche use case)
  • Field-level encryption with AES-256-GCM
  • Key management integration
  • Only implement if explicitly requested

CRITICAL IMPLEMENTATION NOTES:

  • TLS/SSL is CRITICAL for production clusters
  • Certificate rotation must work without cluster downtime
  • Spring Security integration must be seamless
  • Audit logging must ...

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot avatar Nov 08 '25 21:11 Copilot