Merge pull request #20984 from vespa-engine/balder/ensure-deterministic-ordering-of-config-array

Ensure that hostnames are added to config in determinsitic(sorted) or…

2 files changed, 6 insertions, 6 deletions

diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/BlockFeedGlobalEndpointsFilter.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/BlockFeedGlobalEndpointsFilter.java
index da6da75f409..8e8f02e6773 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/BlockFeedGlobalEndpointsFilter.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/BlockFeedGlobalEndpointsFilter.java
@@ -6,13 +6,12 @@ import com.yahoo.component.ComponentSpecification;
 import com.yahoo.component.chain.dependencies.Dependencies;
 import com.yahoo.component.chain.model.ChainedComponentModel;
 import com.yahoo.config.model.api.ContainerEndpoint;
-import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.container.bundle.BundleInstantiationSpecification;
 import com.yahoo.jdisc.http.filter.security.rule.RuleBasedFilterConfig;
-import com.yahoo.path.Path;
 import com.yahoo.vespa.model.clients.ContainerDocumentApi;
 import com.yahoo.vespa.model.container.ContainerCluster;
 
+import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -43,8 +42,9 @@ public class BlockFeedGlobalEndpointsFilter extends Filter implements RuleBasedF
                 .flatMap(e -> e.names().stream())
                 .collect(Collectors.toSet());
         if(hostNames.size() > 0) {
+            Collection<String> hostnamesSorted = hostNames.stream().sorted().collect(Collectors.toList());
             RuleBasedFilterConfig.Rule.Builder rule = new RuleBasedFilterConfig.Rule.Builder()
-                    .hostNames(hostNames)
+                    .hostNames(hostnamesSorted)
                     .pathExpressions(ContainerCluster.RESERVED_URI_PREFIX + "/{*}")
                     .pathExpressions(ContainerDocumentApi.DOCUMENT_V1_PREFIX + "/{*}")
                     .methods(List.of(PUT, POST, DELETE))
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java
index b7bacb34b05..e3aa5bd517f 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java
@@ -10,7 +10,7 @@ import com.yahoo.vespa.model.container.http.ConnectorFactory;
 import java.time.Duration;
 import java.util.Collection;
 import java.util.List;
-import java.util.Set;
+import java.util.stream.Collectors;
 
 /**
  * Component specification for {@link com.yahoo.jdisc.http.server.jetty.ConnectorFactory} with hosted specific configuration.
@@ -88,9 +88,9 @@ public class HostedSslConnectorFactory extends ConnectorFactory {
         connectorBuilder.ssl.enabledProtocols(List.of("TLSv1.2"));
 
         if (!tlsCiphersOverride.isEmpty()) {
-            connectorBuilder.ssl.enabledCipherSuites(tlsCiphersOverride);
+            connectorBuilder.ssl.enabledCipherSuites(tlsCiphersOverride.stream().sorted().collect(Collectors.toList()));
         } else {
-            connectorBuilder.ssl.enabledCipherSuites(Set.copyOf(TlsContext.ALLOWED_CIPHER_SUITES));
+            connectorBuilder.ssl.enabledCipherSuites(TlsContext.ALLOWED_CIPHER_SUITES.stream().sorted().collect(Collectors.toList()));
         }
 
         connectorBuilder