[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Let administrators load replacement TLS keys and trust on running nodes with
{{control.sh --ssl reload}}. IGNITE-29256 makes new TCP connections use the
factory's current context.
h3. Command behavior
# Run on all server and thick-client nodes in the current topology. Include TCP
discovery, communication, the client connector and binary REST where they
started with TLS. If transports share a factory, reload it once per node.
# Require {{ADMIN_OPS}}. Ask for confirmation unless the administrator passes
{{--yes}}.
# Report each node and transport, including nodes with no TLS. Each node logs
its outcome and, when security is enabled, the initiator.
# Continue after individual failures and keep successful replacements in use.
Exit with an error if a target fails, is unsupported or leaves the topology.
h3. Factory behavior
Make {{AbstractSslContextFactory.init()}} public. Reloads of the same factory
run one at a time. Cached {{create()}} calls can return the current context
during loading.
Reload factories that extend {{AbstractSslContextFactory}}. Report other
factory types as unsupported. An override of {{create()}} must get the context
from {{super.create()}} on every call to see a reload. The
{{createKeyManagers()}} and {{createTrustManagers()}} hooks must load fresh
material for their changes to take effect.
h3. Administrator guide
Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to prepare
peer trust across the cluster, replace stores at the configured paths using the
same passwords, and verify the result with a new connection. To recover,
restore the previous files and run reload again. The factory reuses trust
managers supplied through {{setTrustManagers()}}. Changing node configuration
requires a restart.
h3. Acceptance
Verify rotation with a new connection on a server and a thick client. Cover
shared and custom factories, concurrent commands, confirmation, permissions and
outcome logging. Check mixed results, unsupported and departed targets, nodes
with no TLS, and a transport that did not start.
Depends on IGNITE-29256. A separate status command, new certificate-date checks
and background monitoring are outside this ticket.
[Implementation plan in PR #13785|https://github.com/apache/ignite/pull/13785]
was:
Let administrators apply replacement TLS keys and trust material on running
nodes with {{control.sh --ssl reload}}.
h3. What to deliver
# Make {{AbstractSslContextFactory.init()}} public. Calls on the same factory
run one at a time, while cached {{create()}} calls can still return the current
context. An override of {{create()}} sees a reload only if it gets the context
from {{super.create()}} on every call.
# Run the command on all server and thick-client nodes in the current topology.
Reload factories only for TCP discovery, communication, the client connector
and binary REST transports that started with TLS. Reload each factory once per
node even if multiple transports share it. Ask for confirmation unless the
operator passes {{--yes}}.
# Reload factories that extend {{AbstractSslContextFactory}} and report other
factory types as unsupported. A subclass gets new material only if its
{{createKeyManagers()}} and {{createTrustManagers()}} load it on each call.
# Require {{ADMIN_OPS}}. Each node logs its outcome and, when security is
enabled, the initiator. Report results by node and transport, including nodes
with no TLS. Continue after individual failures and keep successful
replacements applied. Exit with an error if a target fails, is unsupported or
leaves the topology.
# Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to add peer
trust across the cluster before rotation, replace store files at the configured
paths with the same passwords, verify the change with a new connection, and
restore the prior files and reload if needed. Trust managers supplied through
{{setTrustManagers()}} are reused.
h3. Acceptance
Verify command-driven rotation with a new connection on server and thick-client
nodes. Cover shared and custom factories, concurrent commands, mixed results,
unsupported and departed targets, the no-TLS result, a transport that did not
start, confirmation, permissions and outcome logging.
Depends on IGNITE-29256. Changing node configuration requires a restart. A
separate status command, new certificate-date checks and background monitoring
are outside this ticket.
[Implementation plan: PR #13785|https://github.com/apache/ignite/pull/13785]
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Let administrators load replacement TLS keys and trust on running nodes with
> {{control.sh --ssl reload}}. IGNITE-29256 makes new TCP connections use the
> factory's current context.
> h3. Command behavior
> # Run on all server and thick-client nodes in the current topology. Include
> TCP discovery, communication, the client connector and binary REST where they
> started with TLS. If transports share a factory, reload it once per node.
> # Require {{ADMIN_OPS}}. Ask for confirmation unless the administrator passes
> {{--yes}}.
> # Report each node and transport, including nodes with no TLS. Each node logs
> its outcome and, when security is enabled, the initiator.
> # Continue after individual failures and keep successful replacements in use.
> Exit with an error if a target fails, is unsupported or leaves the topology.
> h3. Factory behavior
> Make {{AbstractSslContextFactory.init()}} public. Reloads of the same factory
> run one at a time. Cached {{create()}} calls can return the current context
> during loading.
> Reload factories that extend {{AbstractSslContextFactory}}. Report other
> factory types as unsupported. An override of {{create()}} must get the
> context from {{super.create()}} on every call to see a reload. The
> {{createKeyManagers()}} and {{createTrustManagers()}} hooks must load fresh
> material for their changes to take effect.
> h3. Administrator guide
> Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to prepare
> peer trust across the cluster, replace stores at the configured paths using
> the same passwords, and verify the result with a new connection. To recover,
> restore the previous files and run reload again. The factory reuses trust
> managers supplied through {{setTrustManagers()}}. Changing node configuration
> requires a restart.
> h3. Acceptance
> Verify rotation with a new connection on a server and a thick client. Cover
> shared and custom factories, concurrent commands, confirmation, permissions
> and outcome logging. Check mixed results, unsupported and departed targets,
> nodes with no TLS, and a transport that did not start.
> Depends on IGNITE-29256. A separate status command, new certificate-date
> checks and background monitoring are outside this ticket.
> [Implementation plan in PR #13785|https://github.com/apache/ignite/pull/13785]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
