remote: grpcs (grpc+tls) is used by default for remote URLs

RELNOTES: --remote_executor, --remote_cache or --bes_backend=someurl.com would be treated as grpcs://someurl.com, if the --incompatible_tls_enabled_removed flag enabled. See bazelbuild#8061 for details. Closes bazelbuild#8456. PiperOrigin-RevId: 251199122
irengrig · Jul 15, 2019 · a82ecf9 · a82ecf9
1 parent 72cc8ef
commit a82ecf9
Show file tree

Hide file tree

Showing 6 changed files with 90 additions and 47 deletions.
diff --git a/src/main/java/com/google/devtools/build/lib/authandtls/GoogleAuthUtils.java b/src/main/java/com/google/devtools/build/lib/authandtls/GoogleAuthUtils.java
@@ -91,6 +91,12 @@ private static boolean isTlsEnabled(String target, AuthAndTLSOptions options) {
     if (options.incompatibleTlsEnabledRemoved && options.tlsEnabled) {
       throw new IllegalArgumentException("flag --tls_enabled was not found");
     }
+    if (options.incompatibleTlsEnabledRemoved) {
+      // 'grpcs://' or empty prefix => TLS-enabled
+      // when no schema prefix is provided in URL, bazel will treat it as a gRPC request with TLS
+      // enabled
+      return !target.startsWith("grpc://");
+    }
     return target.startsWith("grpcs") || options.tlsEnabled;
   }
 

diff --git a/src/test/py/bazel/windows_remote_test.py b/src/test/py/bazel/windows_remote_test.py
@@ -31,8 +31,8 @@ def _RunRemoteBazel(self, args, env_remove=None, env_add=None):
             '--strategy=Closure=remote',
             '--genrule_strategy=remote',
             '--define=EXECUTOR=remote',
-            '--remote_executor=localhost:' + str(self._worker_port),
-            '--remote_cache=localhost:' + str(self._worker_port),
+            '--remote_executor=grpc://localhost:' + str(self._worker_port),
+            '--remote_cache=grpc://localhost:' + str(self._worker_port),
             '--remote_timeout=3600',
             '--auth_enabled=false',
             '--remote_accept_cached=false',

diff --git a/src/test/shell/bazel/remote/remote_execution_http_test.sh b/src/test/shell/bazel/remote/remote_execution_http_test.sh
@@ -260,15 +260,15 @@ function test_directory_artifact_skylark() {
 
   bazel build \
       --spawn_strategy=remote \
-      --remote_executor=localhost:${worker_port} \
+      --remote_executor=grpc://localhost:${worker_port} \
       //a:test >& $TEST_log \
       || fail "Failed to build //a:test with remote execution"
   diff bazel-genfiles/a/qux/out.txt a/test_expected \
       || fail "Remote execution generated different result"
   bazel clean
   bazel build \
       --spawn_strategy=remote \
-      --remote_executor=localhost:${worker_port} \
+      --remote_executor=grpc://localhost:${worker_port} \
       //a:test >& $TEST_log \
       || fail "Failed to build //a:test with remote execution"
   expect_log "remote cache hit"
@@ -280,14 +280,14 @@ function test_directory_artifact_skylark_grpc_cache() {
   set_directory_artifact_skylark_testfixtures
 
   bazel build \
-      --remote_cache=localhost:${worker_port} \
+      --remote_cache=grpc://localhost:${worker_port} \
       //a:test >& $TEST_log \
       || fail "Failed to build //a:test with remote gRPC cache"
   diff bazel-genfiles/a/qux/out.txt a/test_expected \
       || fail "Remote cache miss generated different result"
   bazel clean
   bazel build \
-      --remote_cache=localhost:${worker_port} \
+      --remote_cache=grpc://localhost:${worker_port} \
       //a:test >& $TEST_log \
       || fail "Failed to build //a:test with remote gRPC cache"
   expect_log "remote cache hit"

diff --git a/src/test/shell/bazel/remote/remote_execution_sandboxing_test.sh b/src/test/shell/bazel/remote/remote_execution_sandboxing_test.sh
@@ -85,17 +85,17 @@ function tear_down() {
 function test_genrule() {
   bazel build \
       --spawn_strategy=remote \
-      --remote_executor=localhost:${worker_port} \
-      --remote_cache=localhost:${worker_port} \
+      --remote_executor=grpc://localhost:${worker_port} \
+      --remote_cache=grpc://localhost:${worker_port} \
       examples/genrule:simple &> $TEST_log \
     || fail "Hermetic genrule failed: examples/genrule:simple"
 }
 
 function test_genrule_can_write_to_path() {
   bazel build \
       --spawn_strategy=remote \
-      --remote_executor=localhost:${worker_port} \
-      --remote_cache=localhost:${worker_port} \
+      --remote_executor=grpc://localhost:${worker_port} \
+      --remote_cache=grpc://localhost:${worker_port} \
       examples/genrule:writes_to_writable_path &> $TEST_log \
     || fail "Hermetic genrule failed: examples/genrule:writes_to_writable_path"
   [ -f "$(cat examples/genrule/writable_path.txt)/out.txt" ] \
@@ -105,8 +105,8 @@ function test_genrule_can_write_to_path() {
 function test_genrule_cannot_write_to_other_path() {
   bazel build \
       --spawn_strategy=remote \
-      --remote_executor=localhost:${worker_port} \
-      --remote_cache=localhost:${worker_port} \
+      --remote_executor=grpc://localhost:${worker_port} \
+      --remote_cache=grpc://localhost:${worker_port} \
       examples/genrule:writes_to_readonly_path &> $TEST_log \
     && fail "Non-hermetic genrule succeeded: examples/genrule:writes_to_readonly_path" || true
   [ -f "$(cat examples/genrule/readonly_path.txt)/out.txt" ] \