[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Let an administrator apply replacement TLS keys and trust material on running
nodes without restarting them.
h3. What to deliver
# Add {{control.sh --ssl reload}} for all server and thick-client nodes in the
current topology. Cover TCP discovery, communication, the client connector and
binary REST.
# Reload each shared factory once per node and serialize its reload requests.
During loading and after failure, new connections use the previous context;
after success, they use the replacement. Established connections stay open.
Preserve TLS settings and client authentication.
# Support the standard factory and custom subclasses following its reload
contract. Document that contract. Report other factory types as unsupported
without changing their normal behavior.
# Require {{ADMIN_OPS}}, log initiator and outcome, and return results by node
and transport. Continue after individual failures; return an error for failed,
unsupported or departed targets. Successful replacements remain applied. Nodes
without TLS need no action.
# Document source replacement, trust preparation, verification with a new
connection and recovery by restoring material and reloading.
h3. Acceptance
Verify all four transports, key and trust rotation, loading failures, existing
and new connections, shared/custom factories, concurrent requests, partial
results, permissions and audit.
Depends on IGNITE-29209. Keep existing loading checks and startup behavior. No
status command, new certificate-date policy or background metrics. Changing
node configuration still requires a restart; local loading success does not
prove peer trust or certificate validity.
[Implementation plan: PR #13785|https://github.com/apache/ignite/pull/13785]
was:
Allow administrators to reload TLS keys and trust material on all server and
thick-client nodes in the current topology with {{control.sh --ssl reload}},
without restarting nodes.
h3. Behavior
* Cover TCP discovery, communication, the client connector and binary REST. Use
IGNITE-29209's factory reload operation and existing context cache. Reload a
shared factory once per node; node-managed loads of the same factory must not
overlap.
* New connections use the replacement after successful loading. During loading
or after failure they use the previous context. Keep established connections
open and preserve TLS settings and client authentication.
* Require {{ADMIN_OPS}} and log the initiator and outcome. Report results by
node and transport. Continue after a failure, returning an error for failed,
unsupported or departed targets. Successful replacements remain applied. Nodes
without TLS need no action.
h3. Scope
Support {{SslContextFactory}} and {{AbstractSslContextFactory}} subclasses that
use the base context cache and loading hooks. Other factories keep their
current behavior and are reported as unsupported by reload. Reread configured
sources; changing node configuration requires a restart.
Keep existing loading checks and startup behavior. Certificate timing and
background monitoring belong to IGNITE-29211; HTTP REST belongs to
IGNITE-29212. No separate {{--ssl status}} command is required.
h3. Acceptance
Test key and trust rotation on all four transports, old and new connections
during loading and after failure, shared factories, custom loaders, overlapping
requests, partial results, permissions and audit.
Document trust preparation, verification with a new connection and recovery by
restoring material and reloading. Successful local loading does not prove peer
trust or certificate validity.
[PR #13785|https://github.com/apache/ignite/pull/13785]
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Let an administrator apply replacement TLS keys and trust material on running
> nodes without restarting them.
> h3. What to deliver
> # Add {{control.sh --ssl reload}} for all server and thick-client nodes in
> the current topology. Cover TCP discovery, communication, the client
> connector and binary REST.
> # Reload each shared factory once per node and serialize its reload requests.
> During loading and after failure, new connections use the previous context;
> after success, they use the replacement. Established connections stay open.
> Preserve TLS settings and client authentication.
> # Support the standard factory and custom subclasses following its reload
> contract. Document that contract. Report other factory types as unsupported
> without changing their normal behavior.
> # Require {{ADMIN_OPS}}, log initiator and outcome, and return results by
> node and transport. Continue after individual failures; return an error for
> failed, unsupported or departed targets. Successful replacements remain
> applied. Nodes without TLS need no action.
> # Document source replacement, trust preparation, verification with a new
> connection and recovery by restoring material and reloading.
> h3. Acceptance
> Verify all four transports, key and trust rotation, loading failures,
> existing and new connections, shared/custom factories, concurrent requests,
> partial results, permissions and audit.
> Depends on IGNITE-29209. Keep existing loading checks and startup behavior.
> No status command, new certificate-date policy or background metrics.
> Changing node configuration still requires a restart; local loading success
> does not prove peer trust or certificate validity.
> [Implementation plan: PR #13785|https://github.com/apache/ignite/pull/13785]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
