[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Let administrators apply replacement TLS keys and trust material on running
nodes with {{control.sh --ssl reload}}.
h3. What to deliver
# Make {{AbstractSslContextFactory.init()}} public. Calls on the same factory
run one at a time, while cached {{create()}} calls can still return the current
context. An override of {{create()}} sees a reload only if it gets the context
from {{super.create()}} on every call.
# Run the command on all server and thick-client nodes in the current topology.
Reload factories only for TCP discovery, communication, the client connector
and binary REST transports that started with TLS. Reload each factory once per
node even if multiple transports share it. Ask for confirmation unless the
operator passes {{--yes}}.
# Reload factories that extend {{AbstractSslContextFactory}} and report other
factory types as unsupported. A subclass gets new material only if its
{{createKeyManagers()}} and {{createTrustManagers()}} load it on each call.
# Require {{ADMIN_OPS}}. Each node logs its outcome and, when security is
enabled, the initiator. Report results by node and transport, including nodes
with no TLS. Continue after individual failures and keep successful
replacements applied. Exit with an error if a target fails, is unsupported or
leaves the topology.
# Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to add peer
trust across the cluster before rotation, replace store files at the configured
paths with the same passwords, verify the change with a new connection, and
restore the prior files and reload if needed. Trust managers supplied through
{{setTrustManagers()}} are reused.
h3. Acceptance
Verify command-driven rotation with a new connection on server and thick-client
nodes. Cover shared and custom factories, concurrent commands, mixed results,
unsupported and departed targets, the no-TLS result, a transport that did not
start, confirmation, permissions and outcome logging.
Depends on IGNITE-29256. Changing node configuration requires a restart. A
separate status command, new certificate-date checks and background monitoring
are outside this ticket.
[Implementation plan: PR #13785|https://github.com/apache/ignite/pull/13785]
was:
Let administrators apply replacement TLS keys and trust material on running
nodes with {{control.sh --ssl reload}}.
h3. What to deliver
# Make {{AbstractSslContextFactory.init()}} public. Calls on the same factory
run one at a time, while cached {{create()}} calls can still return the current
context. An override of {{create()}} sees a reload only if it gets the context
from {{super.create()}} on every call.
# Run the command on all server and thick-client nodes in the current topology.
Reload factories only for TCP discovery, communication, the client connector
and binary REST transports that started with TLS. Reload each factory once per
node even if multiple transports share it. Ask for confirmation unless the
operator passes {{--yes}}.
# Support {{SslContextFactory}} and {{AbstractSslContextFactory}} subclasses
whose {{createKeyManagers()}} and {{createTrustManagers()}} load current
material and whose {{create()}} returns or wraps {{super.create()}}. Ignite
calls {{create()}} for each new connection to a transport using such a factory.
Report other factory types as unsupported and retain their existing call
behavior.
# Require {{ADMIN_OPS}}. Each node logs its outcome and, when security is
enabled, the initiator. Report results by node and transport, including nodes
with no TLS. Continue after individual failures and keep successful
replacements applied. Exit with an error if a target fails, is unsupported or
leaves the topology.
# Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to add peer
trust across the cluster before rotation, replace store files at the configured
paths with the same passwords, verify the change with a new connection, and
restore the prior files and reload if needed. Trust managers supplied through
{{setTrustManagers()}} are reused.
h3. Acceptance
Verify command-driven rotation with a new connection on server and thick-client
nodes. Cover shared and custom factories, concurrent commands, mixed results,
unsupported and departed targets, the no-TLS result, confirmation, permissions
and outcome logging.
Depends on IGNITE-29256. Changing node configuration requires a restart. Verify
peer trust and certificate validity with a fresh connection after a successful
reload. A separate status command, new certificate-date checks and background
monitoring are outside this ticket.
[Implementation plan in PR #13785|https://github.com/apache/ignite/pull/13785]
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Let administrators apply replacement TLS keys and trust material on running
> nodes with {{control.sh --ssl reload}}.
> h3. What to deliver
> # Make {{AbstractSslContextFactory.init()}} public. Calls on the same factory
> run one at a time, while cached {{create()}} calls can still return the
> current context. An override of {{create()}} sees a reload only if it gets
> the context from {{super.create()}} on every call.
> # Run the command on all server and thick-client nodes in the current
> topology. Reload factories only for TCP discovery, communication, the client
> connector and binary REST transports that started with TLS. Reload each
> factory once per node even if multiple transports share it. Ask for
> confirmation unless the operator passes {{--yes}}.
> # Reload factories that extend {{AbstractSslContextFactory}} and report other
> factory types as unsupported. A subclass gets new material only if its
> {{createKeyManagers()}} and {{createTrustManagers()}} load it on each call.
> # Require {{ADMIN_OPS}}. Each node logs its outcome and, when security is
> enabled, the initiator. Report results by node and transport, including nodes
> with no TLS. Continue after individual failures and keep successful
> replacements applied. Exit with an error if a target fails, is unsupported or
> leaves the topology.
> # Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to add
> peer trust across the cluster before rotation, replace store files at the
> configured paths with the same passwords, verify the change with a new
> connection, and restore the prior files and reload if needed. Trust managers
> supplied through {{setTrustManagers()}} are reused.
> h3. Acceptance
> Verify command-driven rotation with a new connection on server and
> thick-client nodes. Cover shared and custom factories, concurrent commands,
> mixed results, unsupported and departed targets, the no-TLS result, a
> transport that did not start, confirmation, permissions and outcome logging.
> Depends on IGNITE-29256. Changing node configuration requires a restart. A
> separate status command, new certificate-date checks and background
> monitoring are outside this ticket.
> [Implementation plan: PR #13785|https://github.com/apache/ignite/pull/13785]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
