feat: use grpc secure channel #783

etiennearnal · 2025-11-26T10:53:27Z

Description

Including the usage of secure channels upon Speos client.
Secure channel creation is based on cyberchannel.
[breaking change] Speos constructor parameters host and port are removed. Please consider to create the grpc.Channel using default_local_channel:

# Create default channel (to use when server was started with `SpeosRPC_Server.exe`)
Speos(channel=default_local_channel())
# Create channel with custom port and message size (to use when server was started with `SpeosRPC_Server.exe --port 53123`)
Speos(channel=default_local_channel(port=53123, message_size=20000000))
# Create insecure channel (to use when server was started with `SpeosRPC_Server.exe --transport-insecure`)
transport = TransportOptions(
    mode=TransportMode.INSECURE,
    options=InsecureOptions(host=host, port=port, allow_remote_host=True)
)
grpc_options = [("grpc.max_receive_message_length", message_size)]
Speos(channel=transport.create_channel(grpc_options))

Checklist

I have tested my changes locally.
I have added necessary documentation or updated existing documentation.
I have followed the coding style guidelines of this project.
I have added appropriate tests (unit, integration, system).
I have reviewed my changes before submitting this pull request.
I have linked the issue or issues that are solved by the PR if any.
I have assigned this PR to myself.
I have made sure that the title of my PR follows Conventional commits style (e.g. feat: add optical property)
I have agreed with the Contributor License Agreement (CLA).

…nto feat/secure-grpc

src/ansys/speos/core/launcher.py

codecov · 2025-11-28T08:24:26Z

Codecov Report

❌ Patch coverage is 58.73016% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.03%. Comparing base (4b67954) to head (988ec62).

Files with missing lines	Patch %	Lines
...c/ansys/speos/core/kernel/grpc/transportoptions.py	71.62%	21 Missing ⚠️
src/ansys/speos/core/kernel/client.py	35.00%	13 Missing ⚠️
src/ansys/speos/core/kernel/job.py	59.09%	9 Missing ⚠️
src/ansys/speos/core/launcher.py	10.00%	9 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #783      +/-   ##
==========================================
- Coverage   88.99%   87.03%   -1.97%     
==========================================
  Files          39       40       +1     
  Lines        5653     5760     +107     
==========================================
- Hits         5031     5013      -18     
- Misses        622      747     +125

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

pluAtAnsys · 2025-11-29T12:50:04Z

src/ansys/speos/core/launcher.py

    err, stderr_file = tempfile.mkstemp(suffix="speos_err.txt", dir=logfile_loc)

    subprocess.Popen(command, stdout=out, stderr=err)  # nosec B603
    return Speos(


this will not create local RPC server if using version before 2025.2.3. We can:
Option 1. if version <= 252, using the previous Speos method and raise security warning message
Option 2. raise error directly that this method only supports from 252.
@etiennearnal @StefanThoene @jomadec

@pluAtAnsys we did Service Packs for all previous releases of SpeosRPC_Server (251 & 252), so the goal is to no more support the previous versions that has the vulnerabilities.
I think we have to move forward and consider that users have to use the latest available Service Pack (supporting --transport_xxx option). In other cases, user can duplicate the function manually on there side.

pluAtAnsys · 2025-11-29T13:54:22Z

tests/core/test_launcher.py

    assert running is not closed
-
-
-@patch.object(subprocess, "Popen")


@StefanThoene let's check on this

@pluAtAnsys The test doesn't make any sense, client cannot start a docker from python. Docker image must be started by user before launching the tests.

BTW, the code seems to launch a local SpeosRPC_Server.

src/ansys/speos/core/kernel/client.py

pluAtAnsys · 2025-11-29T14:25:07Z

doc/source/getting_started/docker/common_docker.rst

-    from ansys.speos.core import Speos
-
-    speos = Speos(host="127.0.0.1", port=50098)
+   speos = Speos(channel = default_docker_channel())


Suggested change

speos = Speos(channel = default_docker_channel())

speos = Speos()

Be aware that such docker is launched via insecure channel

By default, the ``Speos`` instance connects to ``"localhost"`` on

port ``50098``.

You can change this by modifying the ``host`` and ``port``

parameters of ``default_docker_channel``, but note that you must also modify

your ``docker run`` command by changing the ``<HOST-PORT>-50098`` argument.

The following tabs show the commands that set the ``host`` and ``port``

parameters of ``default_docker_channel``.

.. code:: python

from ansys.speos.core import Speos, default_docker_channel

speos = Speos(channel = default_docker_channel(host="127.0.0.1", port=50098))

@etiennearnal @jomadec could you please review this? also, could we provide explanation/an example to launch docker in secure way?

echambla · 2025-12-03T09:27:06Z

.github/workflows/nightly.yml

+          elif [[ "$speos_version" == "dev" ]]; then
            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e SPEOS_LOG_LEVEL=2 -e ANSYSLMD_LICENSE_FILE=${{ env.ANSYSLMD_LICENSE_FILE }} -v "${{ github.workspace }}/tests/assets:/app/assets" --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:$speos_version -m 25000000 --host 0.0.0.0
+          elif [[ "$speos_version" == "2025.2.4.35476" ]]; then
+            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e SPEOS_LOG_LEVEL=2 -e ANSYSLMD_LICENSE_FILE=${{ env.ANSYSLMD_LICENSE_FILE }} -v "${{ github.workspace }}/tests/assets:/app/assets" --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:$speos_version -m 25000000 --transport_insecure--host 0.0.0.0


Suggested change

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e SPEOS_LOG_LEVEL=2 -e ANSYSLMD_LICENSE_FILE=${{ env.ANSYSLMD_LICENSE_FILE }} -v "${{ github.workspace }}/tests/assets:/app/assets" --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:$speos_version -m 25000000 --transport_insecure--host 0.0.0.0

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e SPEOS_LOG_LEVEL=2 -e ANSYSLMD_LICENSE_FILE=${{ env.ANSYSLMD_LICENSE_FILE }} -v "${{ github.workspace }}/tests/assets:/app/assets" --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:$speos_version -m 25000000 --transport_insecure --host 0.0.0.0

echambla · 2025-12-03T09:31:30Z

doc/source/getting_started/docker/common_docker.rst


            export LICENSE_SERVER="[email protected]"
-            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:251
+            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure


Suggested change

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure --host 0.0.0.0

echambla · 2025-12-03T09:31:46Z

doc/source/getting_started/docker/common_docker.rst


            $env:LICENSE_SERVER="[email protected]"
-            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$env:LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:251
+            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$env:LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure


Suggested change

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$env:LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$env:LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure --host 0.0.0.0

echambla · 2025-12-03T09:32:02Z

doc/source/getting_started/docker/common_docker.rst


            set LICENSE_SERVER="[email protected]"
-            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=%LICENSE_SERVER% --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:251
+            docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=%LICENSE_SERVER% --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure


Suggested change

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=%LICENSE_SERVER% --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=%LICENSE_SERVER% --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure --host 0.0.0.0

echambla · 2025-12-03T09:33:23Z

README.rst

   cat GH_TOKEN.txt | docker login ghcr.io -u "$GH_USERNAME" --password-stdin
   docker pull ghcr.io/ansys/speos-rpc:251
-   docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:251
+   docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:251 --transport_insecure


Suggested change

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:251 --transport_insecure

docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e ANSYSLMD_LICENSE_FILE=$LICENSE_SERVER --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:252 --transport_insecure --host 0.0.0.0

echambla · 2025-12-03T09:50:48Z

src/ansys/speos/core/kernel/client.py

            return False
        try:
-            grpc.channel_ready_future(self.channel).result(timeout=60)
+            grpc.channel_ready_future(self.channel).result(timeout=10)


Was the default timeout changed on purpose?

etiennearnal and others added 8 commits November 25, 2025 12:34

secure grpc channel

746c1d8

apply precommit

466371c

tests on local linux

8ba51f3

fix

e002f9a

little fix

e9ee91f

fix

f35bfb1

Merge branch 'feat/secure-grpc' of https://github.com/ansys/pyspeos i…

050d707

…nto feat/secure-grpc

precommit apply

6bad5d6

etiennearnal requested review from StefanThoene, echambla, jomadec and pluAtAnsys as code owners November 26, 2025 10:53

github-actions bot added documentation Improvements or additions to documentation maintenance Package and maintenance related testing Anything related to tests enhancement New features or code improvements labels Nov 26, 2025

chore: adding changelog file 783.added.md [dependabot-skip]

cb69209

etiennearnal changed the title ~~feat: Use gRPC secure channel~~ feat: use grpc secure channel Nov 26, 2025

chore: adding changelog file 783.added.md [dependabot-skip]

0b418cf

echambla assigned etiennearnal Nov 26, 2025

etiennearnal commented Nov 26, 2025

View reviewed changes

src/ansys/speos/core/launcher.py Outdated Show resolved Hide resolved

jmadec and others added 2 commits November 26, 2025 15:14

add default transport options for server launch local

a2b3e33

fix

4c455a3

etiennearnal requested review from Revathyvenugopal162 and SMoraisAnsys as code owners November 27, 2025 09:09

etiennearnal added 3 commits November 27, 2025 16:32

fix-ci

b812460

Merge remote-tracking branch 'origin/main' into feat/secure-grpc

72d809e

remove-ut-test_coverage_launcher_speosdocker

76876a2

fix bandit

76a080c

fix

90a2c7a

pluAtAnsys reviewed Nov 29, 2025

View reviewed changes

add examples to Speos initialization

988ec62

echambla reviewed Dec 3, 2025

View reviewed changes

		assert running is not closed


		@patch.object(subprocess, "Popen")

-   speos = Speos(channel = default_docker_channel())
+   speos = Speos()
+Be aware that such docker is launched via insecure channel
+By default, the ``Speos`` instance connects to ``"localhost"`` on
+port ``50098``.
+You can change this by modifying the ``host`` and ``port``
+parameters of ``default_docker_channel``, but note that you must also modify
+your ``docker run`` command by changing the ``<HOST-PORT>-50098`` argument.
+The following tabs show the commands that set the ``host`` and ``port``
+parameters of ``default_docker_channel``.
+.. code:: python
+    from ansys.speos.core import Speos, default_docker_channel
+    speos = Speos(channel = default_docker_channel(host="127.0.0.1", port=50098))

	docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e SPEOS_LOG_LEVEL=2 -e ANSYSLMD_LICENSE_FILE=${{ env.ANSYSLMD_LICENSE_FILE }} -v "${{ github.workspace }}/tests/assets:/app/assets" --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:$speos_version -m 25000000 --transport_insecure--host 0.0.0.0
	docker run --detach --name speos-rpc -p 127.0.0.1:50098:50098 -e SPEOS_LOG_LEVEL=2 -e ANSYSLMD_LICENSE_FILE=${{ env.ANSYSLMD_LICENSE_FILE }} -v "${{ github.workspace }}/tests/assets:/app/assets" --entrypoint /app/SpeosRPC_Server.x ghcr.io/ansys/speos-rpc:$speos_version -m 25000000 --transport_insecure --host 0.0.0.0

feat: use grpc secure channel #783

Are you sure you want to change the base?

feat: use grpc secure channel #783

Uh oh!

Conversation

etiennearnal commented Nov 26, 2025 • edited by echambla Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

Uh oh!

codecov bot commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

etiennearnal commented Nov 26, 2025 •

edited by echambla

Loading

codecov bot commented Nov 28, 2025 •

edited

Loading