smolnar82 opened a new pull request, #1388: URL: https://github.com/apache/knox/pull/1388
[KNOX-3238](https://issues.apache.org/jira/browse/KNOX-3238) - Migrate `javax.servlet` to `jakarta.servlet` (Jetty EE8 → EE10 / Servlet 6) ## What changes were proposed in this pull request? Moves Knox off the `javax.servlet` namespace and Jetty's EE8 compatibility environment onto **Jakarta EE10 / Servlet 6** (`jakarta.servlet-api:6.0.0`), keeping `jetty.version=12.0.38`. The Jetty 9→12 handler/bootstrap port already landed on master (KNOX-3420); this PR is the namespace/EE-level flip that remained. - **Namespace flip** — `javax.servlet.*`, `javax.websocket.*`, and `javax.ws.rs.*` imports/FQNs migrated to `jakarta.*` across all modules. - **Dependency stack → EE10 / jakarta**: - Jetty `jetty-ee8-*` → `jetty-ee10-*` (`servlet`, `servlets`, `webapp`, `annotations`, `apache-jsp`, `glassfish-jstl`, and the `websocket-jakarta-server/-client` + `websocket-servlet` modules); dropped the EE8 `nested` layer. Core `jetty-websocket-jetty-server/-api` kept (environment-neutral, used by the inbound upgrade path). - `jakarta.servlet-api:6.0.0`, `jakarta.ws.rs-api:3.1.0`, `jakarta.websocket-api:2.1.1`, `jakarta.annotation-api:2.1.1`, `jakarta.inject-api:2.0.1`. - Jersey `3.1.12` (jakarta `jersey-container-servlet(-core)`), pac4j servlet adapter on the jakarta line (`jakartaee-pac4j` / `pac4j-jakartaee`), Dropwizard `metrics-jakarta-servlets`, Ehcache `3.10.9` (jakarta). - **EE10 bootstrap** (`gateway-server`): `GatewayServer` now builds `org.eclipse.jetty.ee10.webapp.WebAppContext`, uses the `ee10` init-param / container-jar-pattern keys, the EE10 JSP/JSTL jar filter, `FormFields` limits, and an EE10 servlet-based `KnoxErrorHandler`. - **WebSocket** (`gateway-server/.../websockets`): endpoints on `jakarta.websocket.*`; backend client container provider switched to `JakartaWebSocketClientContainerProvider`. - **Hadoop javax↔jakarta bridge** (`gateway-provider-security-hadoopauth`): `hadoop-auth 3.4.1` compiles only against `javax.servlet` and has no Jakarta release. Rather than disabling `HadoopAuthFilter`, this PR keeps it **functional** via a scoped bridge: an outer `HadoopAuthFilter implements jakarta.servlet.Filter` delegates to an inner `javax` `AuthenticationFilter`, with jakarta→javax adapters for `FilterConfig`/`ServletContext`/`HttpServletRequest`/`HttpServletResponse` and a `javax`→`jakarta` `FilterChain` that unwraps back to the real chain. This is the only place `javax.servlet` remains, by design. - **JAXB provider** — pinned `jakarta.xml.bind-api` to `3.0.2`. The 4.0.x API's `ContextFinder` dropped `jaxb.properties` support, which caused the Glassfish RI to be selected over MOXy and reject Knox's MOXy-only bindings (`eclipselink.oxm.metadata-source`, `MEDIA_TYPE`). `3.0.2` still honors the per-package provider selector, so MOXy 4.0.9 stays the provider. - **Encoded path separators** — Servlet 6 rejects ambiguous URIs (e.g. `%2F`) with 400. Knox proxies backends (WebHDFS/WEBHBASE row keys) whose paths carry encoded slashes, so the connector uses `UriCompliance.LEGACY` and each deployed context enables `ServletHandler.setDecodeAmbiguousURIs(true)`, restoring the Jetty 9.4 pass-through behavior. - **Docs** — dev-guide filter examples and the servlet-api Maven snippet updated to `jakarta.servlet`. ## How was this patch tested? - **`mvn verify`** (default `dev` profile): **BUILD SUCCESS**, 0 failures / 0 errors across the full reactor. `GatewayBasicFuncTest` runs **43/43 with 0 skipped** — including `testEncodedForwardSlash`, which passes on the EE10 stack rather than being disabled. - **`mvn clean install`** with `apache-rat` and `forbiddenapis` active: **BUILD SUCCESS**, all 100 modules, **0 forbiddenapis errors**, license headers clean. - Sanity checks: no `rewrite-maven-plugin` left in any pom, no residual `javax.websocket` / `jetty-ee8`, and `import javax.servlet` appears **only** in the intentional hadoopauth bridge classes. - **Not covered by this run**: a live end-to-end smoke test (starting a real gateway against a backend + KDC). Reviewers may want to exercise a WebHDFS proxy and a hadoopauth/Kerberos flow manually. **Disabled tests (documented, unavoidable):** `ShellTest` (x2), `SecureClusterTest`, and `SecureKnoxShellTest` in `gateway-test-release/webhdfs*` are annotated `@Ignore //jetty-12-upgrade-ignore`. They boot Hadoop's own bundled Jetty 9 `HttpServer2` (`javax.servlet`) on the **test** classpath, which cannot coexist with the Jetty 12 / EE10 `jakarta.servlet` runtime. This is a test-harness limitation, not a gateway limitation, and cannot be fixed by the bridge (which only covers the gateway's own filter chain). ## Integration Tests No changes required to `.github/workflows/tests`. The migration is at the servlet/container layer and preserves runtime behavior, so the existing Docker Compose E2E suites continue to apply unchanged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
