[
https://issues.apache.org/jira/browse/IGNITE-29211?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137763#comment-18137763
]
Anton Vinogradov commented on IGNITE-29211:
-------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13786] verdict for PR
13786 · RunAll build [9469345|https://ci2.ignite.apache.org/build/9469345] ·
tested
[820e07c|https://github.com/apache/ignite/pull/13786/commits/820e07c74b584eba386cd08afb0006214cc1da88]
· 149 suites ran, 0 reused
(!) *This run doesn't cover the PR fully:*
- 1 suite ran fewer tests than the same suite on master
Everything below is what it did manage to say.
(?) *1 suite ran fewer tests than on master* (tests that never ran can't fail):
- PDS 3: ran 45 of master's 52 tests (*-13%*)
(?) *No blockers found — but the run above can't prove the PR is clean.* 25
failing tests are not blamed on this PR. Re-run after you handle what is listed
above.
_What each label means and what to do: [verdict
glossary|https://github.com/anton-vinogradov/ignite-pr-checker/blob/main/docs/features.md#verdict-glossary]._
♻️ Settled after 2 auto re-run waves: #1 — 2 suites that failed mid-run; #2 — 2
suites (1 with blockers, 1 broken).
> Renew TLS certificates automatically before expiry
> --------------------------------------------------
>
> Key: IGNITE-29211
> URL: https://issues.apache.org/jira/browse/IGNITE-29211
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Load externally supplied replacement certificates before the current chains
> expire, without a reload command for each scheduled rotation. Ignite does not
> issue certificates or watch files; trust-store-only changes and immediate
> operator action still use {{--ssl reload}}.
> h3. Result and acceptance
> * Renewal is opt-in. Schedule from the earliest expiry across all reported
> X.509 chains, including CA certificates. Require available, nonempty metadata
> at startup and on replacement. Respect custom factory policies for enabling
> renewal and selecting its window.
> * Install the whole replacement only when all reported certificates are
> currently valid and the earliest expiry advances. Alias changes are allowed.
> Failure or unchanged expiry retains current material; retry with bounded
> backoff and jitter, including after expiry.
> * Serialize automatic attempts and manual {{init()}}. Direct initialization
> replans renewal; stale or interrupted attempts must not install material.
> Shutdown ends renewal without counting cancellation as a reload or renewal
> failure.
> * Show the next attempt in {{--ssl status}}.
> {{ssl.ConsecutiveRenewalFailures}} sums unsuccessful automatic attempts
> across distinct factories, counting a shared factory once. Unchanged expiry
> counts; failed manual reloads do not. Reset a factory's count only when an
> installed bundle advances earliest expiry.
> h3. Operation and lifecycle
> Configure renewal before startup; changing its settings requires a restart.
> Use a separate renewal-enabled factory per running node; it may attach to a
> new node after the old executor stops. Reusing an initialized factory retains
> material until {{init()}} or successful renewal.
> Entries without eligible X.509 chains are omitted from monitoring. Renewal
> does not prove peer trust. See [rollout and
> recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29211/docs/_docs/security/ssl-tls.adoc#renewing-certificates-automatically]
> and the [setting contracts and
> defaults|https://github.com/anton-vinogradov/ignite/blob/ignite-29211/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L163].
> h3. Delivery and HTTP integration
> Depends on IGNITE-29210. IGNITE-29212 may merge before or after this task.
> Once both are present, include the [joint integration
> commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
> once in the PR that merges second; it adds HTTPS renewal coverage and
> documentation.
> Local checks: all 35 renewal/node cases and Checkstyle passed at
> {{a4bd1b1c}}; combined HTTPS renewal passed at {{fe6d4afd}}. This is not full
> CI.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
