[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Replace TLS certificates and trust on running nodes while established
connections stay open. An external source supplies the replacement material.
Ignite loads it on command or, if automatic renewal is enabled, before expiry.
h3. Work and merge order
Already completed: IGNITE-29208 keeps peer information on wrapped SSL engines.
[PR #13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 lets factory subclasses replace their cached SSL context.
# IGNITE-29256 makes new connections on the four TCP transports use the
factory's current context.
# IGNITE-29210 adds manual reload with permissions, per-node results and a log
of the outcome.
# IGNITE-29211 adds automatic renewal, certificate date checks, retries and a
failure metric.
# IGNITE-29212 adds factory-managed HTTPS to manual reload and automatic
renewal. HTTPS configured directly in Jetty XML keeps its existing setup and
stays outside reload.
Merge the numbered tickets in order. After each merge, refresh the dependent
PRs so each diff shows only its own changes. IGNITE-29212 includes the HTTPS
renewal test and adds HTTPS to the reload and renewal documentation.
h3. Acceptance
Verify key and trust rotation on every supported transport, automatic renewal,
established connections, failure recovery and monitoring. Each ticket defines
its own checks. Record the implementation and verification in its PR.
Certificate issuance, live node reconfiguration, a separate status command,
certificate inventory and support for every factory type are outside this
scope. Verify peer trust with a new connection after loading a replacement.
was:
Rotate TLS certificates and trust on running nodes without closing established
connections. An external source supplies the material; Ignite loads it on
command or, when enabled, before expiry.
h3. Deliverables
# IGNITE-29208: preserve peer information on wrapped SSL engines. Already
merged in [PR #13750|https://github.com/apache/ignite/pull/13750].
# IGNITE-29209: let a factory subclass reload its context while preserving
existing cached creation behavior.
# IGNITE-29256: make new connections of the four TCP transports use the
factory's current context.
# IGNITE-29210: provide authorized manual reload for the four TCP transports,
with per-node results and an outcome log.
# IGNITE-29211: add automatic renewal, necessary expiry checks, retries and
failure monitoring.
# IGNITE-29212: add factory-managed HTTPS, include it in manual reload and
renewal; HTTPS configured in Jetty XML stays unchanged and outside reload.
h3. Order and completeness
Merge in this order: IGNITE-29209, IGNITE-29256, IGNITE-29210, IGNITE-29211,
IGNITE-29212. IGNITE-29212 includes the HTTPS renewal test and adds HTTPS to
the reload and renewal documentation. Refresh dependent PRs after each
prerequisite merges; their diffs must contain only their remaining changes.
Each ticket defines its required results and acceptance checks. Its PR explains
the implementation and records verification. Confirm key/trust rotation on all
supported transports, automatic renewal, established connections, failure
recovery and monitoring.
Certificate issuance, live node reconfiguration, a separate status command,
certificate inventory and universal support for arbitrary factories are outside
this scope. Local loading success alone does not establish peer trust.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 7h
> Remaining Estimate: 0h
>
> Replace TLS certificates and trust on running nodes while established
> connections stay open. An external source supplies the replacement material.
> Ignite loads it on command or, if automatic renewal is enabled, before expiry.
> h3. Work and merge order
> Already completed: IGNITE-29208 keeps peer information on wrapped SSL
> engines. [PR #13750|https://github.com/apache/ignite/pull/13750] is merged.
> # IGNITE-29209 lets factory subclasses replace their cached SSL context.
> # IGNITE-29256 makes new connections on the four TCP transports use the
> factory's current context.
> # IGNITE-29210 adds manual reload with permissions, per-node results and a
> log of the outcome.
> # IGNITE-29211 adds automatic renewal, certificate date checks, retries and a
> failure metric.
> # IGNITE-29212 adds factory-managed HTTPS to manual reload and automatic
> renewal. HTTPS configured directly in Jetty XML keeps its existing setup and
> stays outside reload.
> Merge the numbered tickets in order. After each merge, refresh the dependent
> PRs so each diff shows only its own changes. IGNITE-29212 includes the HTTPS
> renewal test and adds HTTPS to the reload and renewal documentation.
> h3. Acceptance
> Verify key and trust rotation on every supported transport, automatic
> renewal, established connections, failure recovery and monitoring. Each
> ticket defines its own checks. Record the implementation and verification in
> its PR.
> Certificate issuance, live node reconfiguration, a separate status command,
> certificate inventory and support for every factory type are outside this
> scope. Verify peer trust with a new connection after loading a replacement.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
