[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Allow administrators to reload TLS certificates and trust material on all
server and thick-client nodes in the current topology with {{control.sh --ssl
reload}}, without restarting nodes or closing established connections.
h3. Behavior
* Cover TCP discovery, communication, the client connector and binary REST.
Reload each shared factory once per node, using {{init()}} from IGNITE-29209
and the existing context cache. Reloads of the same factory must not overlap.
* New connections use the replacement after successful loading. During loading,
or if it fails, they continue using the previous context. Preserve existing TLS
settings and client authentication.
* Require {{ADMIN_OPS}} and log the initiator and outcome. Report results by
node and transport; continue after individual failures and return an error for
failed, unsupported or unavailable targets. Report selected nodes that leave
the topology as unavailable. Successful replacements remain applied after a
partial failure. Nodes without TLS need no action.
h3. Scope
Support {{SslContextFactory}} and subclasses using the base context lifecycle,
including custom key and trust loaders. Other factories retain their current
behavior; the command reports that reload is unsupported. Reread the configured
sources; changing node configuration still requires a restart.
Keep existing loading checks and startup behavior. Separate {{--ssl status}},
certificate metadata, additional certificate-date checks, automatic renewal and
HTTP REST are outside this ticket. Monitoring of background renewal belongs to
IGNITE-29211.
h3. Acceptance
Test certificate and trust replacement on all four transports, old and new
connections, failed loading, shared factories, custom loading hooks, partial
failures and permissions.
Document trust preparation and verification with a new TLS connection:
successful local loading does not prove that peers accept the certificate. If
verification fails, restore the previous material and reload.
Depends on IGNITE-29209. [PR
#13785|https://github.com/apache/ignite/pull/13785].
was:
Allow administrators to reload TLS certificates and trust material on running
server and thick-client nodes with {{control.sh --ssl reload}}, without
restarting nodes or closing established connections.
h3. Behavior
* Cover TCP discovery, communication, the client connector and binary REST.
Reload each shared factory once per node, using {{init()}} from IGNITE-29209
and the existing context cache.
* New connections use the replacement after successful loading. During loading,
or if it fails, they continue using the previous context. Preserve existing TLS
settings and client authentication.
* Require {{ADMIN_OPS}} and log the initiator and outcome. Report results by
node and transport; continue after individual failures and return an error for
failed, unsupported or unavailable targets. Nodes without TLS need no action.
h3. Scope
Support {{SslContextFactory}} and subclasses using the base context lifecycle,
including custom key and trust loaders. Other factories retain their current
behavior; the command reports that reload is unsupported. Reread the configured
sources; changing node configuration still requires a restart.
Keep existing loading checks and startup behavior. Separate {{--ssl status}},
certificate metadata, additional certificate-date checks, automatic renewal and
HTTP REST are outside this ticket.
h3. Acceptance
Test certificate and trust replacement on all four transports, old and new
connections, failed loading, shared factories, custom loading hooks, partial
failures and permissions.
Document trust preparation and verification with a new TLS connection:
successful local loading does not prove that peers accept the certificate. If
verification fails, restore the previous material and reload.
Depends on IGNITE-29209. [PR
#13785|https://github.com/apache/ignite/pull/13785].
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Allow administrators to reload TLS certificates and trust material on all
> server and thick-client nodes in the current topology with {{control.sh --ssl
> reload}}, without restarting nodes or closing established connections.
> h3. Behavior
> * Cover TCP discovery, communication, the client connector and binary REST.
> Reload each shared factory once per node, using {{init()}} from IGNITE-29209
> and the existing context cache. Reloads of the same factory must not overlap.
> * New connections use the replacement after successful loading. During
> loading, or if it fails, they continue using the previous context. Preserve
> existing TLS settings and client authentication.
> * Require {{ADMIN_OPS}} and log the initiator and outcome. Report results by
> node and transport; continue after individual failures and return an error
> for failed, unsupported or unavailable targets. Report selected nodes that
> leave the topology as unavailable. Successful replacements remain applied
> after a partial failure. Nodes without TLS need no action.
> h3. Scope
> Support {{SslContextFactory}} and subclasses using the base context
> lifecycle, including custom key and trust loaders. Other factories retain
> their current behavior; the command reports that reload is unsupported.
> Reread the configured sources; changing node configuration still requires a
> restart.
> Keep existing loading checks and startup behavior. Separate {{--ssl status}},
> certificate metadata, additional certificate-date checks, automatic renewal
> and HTTP REST are outside this ticket. Monitoring of background renewal
> belongs to IGNITE-29211.
> h3. Acceptance
> Test certificate and trust replacement on all four transports, old and new
> connections, failed loading, shared factories, custom loading hooks, partial
> failures and permissions.
> Document trust preparation and verification with a new TLS connection:
> successful local loading does not prove that peers accept the certificate. If
> verification fails, restore the previous material and reload.
> Depends on IGNITE-29209. [PR
> #13785|https://github.com/apache/ignite/pull/13785].
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
