[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Replacing key-store and trust-store files does not update a running node: its
SSL context still holds the previously loaded material. Add a way to load
replacements without restarting nodes or closing established connections.
Administrators can trigger a reload; optional automatic renewal can load
certificates supplied by an external source before expiry.
h3. Deliver in this order
# *IGNITE-29209 — reload the factory.* Build a replacement SSL context before
replacing the cached one. A failed load leaves the working context available.
# *IGNITE-29256 — use the replacement.* Make new TCP connections obtain the
factory's current context. Replacing the factory cache alone does not update
contexts retained by transports.
# *IGNITE-29210 — add the administrator command.* Reload the factories on
running nodes, check permissions and report each outcome. Operators need to see
partial failures as well as successful replacements.
# *IGNITE-29211 — renew automatically.* Schedule loads before certificate
expiry, retry unusable replacements and expose failures in logs and a metric.
# *IGNITE-29212 — include HTTPS.* Connect HTTP REST to the existing reload and
renewal mechanism. HTTPS configured directly in Jetty XML keeps working outside
this mechanism.
Merge in this order. After each prerequisite merges, refresh the dependent PR
so its diff contains only its own changes. IGNITE-29208, which preserves peer
information on wrapped SSL engines, is already
[merged|https://github.com/apache/ignite/pull/13750].
h3. Done when
New connections use replacement keys and trust on discovery, communication, the
client connector, binary REST and factory-managed HTTP REST. Established
connections stay usable. Failed loads preserve the working context, and
administrators can identify and recover from failures. Verify peer trust
through new connections after both manual reload and automatic renewal; the
final HTTPS ticket includes their HTTP tests and documentation.
Ignite loads certificates; it does not issue them. Changing node configuration
still requires a restart. A separate status command, certificate inventory and
reload support for arbitrary factory types are outside this work.
was:
Replace TLS certificates and trust on running nodes while established
connections stay open. An external source supplies the replacement material.
Ignite loads it on command or, if automatic renewal is enabled, before expiry.
h3. Work and merge order
Already completed: IGNITE-29208 keeps peer information on wrapped SSL engines.
[PR #13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 lets factory subclasses replace their cached SSL context.
# IGNITE-29256 makes new connections on the four TCP transports use the
factory's current context.
# IGNITE-29210 adds manual reload with permissions, per-node results and a log
of the outcome.
# IGNITE-29211 adds automatic renewal, certificate date checks, retries and a
failure metric.
# IGNITE-29212 adds factory-managed HTTPS to manual reload and automatic
renewal. HTTPS configured directly in Jetty XML keeps its existing setup and
stays outside reload.
Merge the numbered tickets in order. After each merge, refresh the dependent
PRs so each diff shows only its own changes. IGNITE-29212 includes the HTTPS
renewal test and adds HTTPS to the reload and renewal documentation.
h3. Acceptance
Verify key and trust rotation on every supported transport, automatic renewal,
established connections, failure recovery and monitoring. Each ticket defines
its own checks. Record the implementation and verification in its PR.
Certificate issuance, live node reconfiguration, a separate status command,
certificate inventory and support for every factory type are outside this
scope. Verify peer trust with a new connection after loading a replacement.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 7h
> Remaining Estimate: 0h
>
> Replacing key-store and trust-store files does not update a running node: its
> SSL context still holds the previously loaded material. Add a way to load
> replacements without restarting nodes or closing established connections.
> Administrators can trigger a reload; optional automatic renewal can load
> certificates supplied by an external source before expiry.
> h3. Deliver in this order
> # *IGNITE-29209 — reload the factory.* Build a replacement SSL context before
> replacing the cached one. A failed load leaves the working context available.
> # *IGNITE-29256 — use the replacement.* Make new TCP connections obtain the
> factory's current context. Replacing the factory cache alone does not update
> contexts retained by transports.
> # *IGNITE-29210 — add the administrator command.* Reload the factories on
> running nodes, check permissions and report each outcome. Operators need to
> see partial failures as well as successful replacements.
> # *IGNITE-29211 — renew automatically.* Schedule loads before certificate
> expiry, retry unusable replacements and expose failures in logs and a metric.
> # *IGNITE-29212 — include HTTPS.* Connect HTTP REST to the existing reload
> and renewal mechanism. HTTPS configured directly in Jetty XML keeps working
> outside this mechanism.
> Merge in this order. After each prerequisite merges, refresh the dependent PR
> so its diff contains only its own changes. IGNITE-29208, which preserves peer
> information on wrapped SSL engines, is already
> [merged|https://github.com/apache/ignite/pull/13750].
> h3. Done when
> New connections use replacement keys and trust on discovery, communication,
> the client connector, binary REST and factory-managed HTTP REST. Established
> connections stay usable. Failed loads preserve the working context, and
> administrators can identify and recover from failures. Verify peer trust
> through new connections after both manual reload and automatic renewal; the
> final HTTPS ticket includes their HTTP tests and documentation.
> Ignite loads certificates; it does not issue them. Changing node
> configuration still requires a restart. A separate status command,
> certificate inventory and reload support for arbitrary factory types are
> outside this work.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
