[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Allow administrators to replace node TLS certificates and trust stores without
restarting nodes. When an external system delivers certificates, let Ignite
load valid replacements automatically before the current chains expire.
Existing connections remain usable; peer trust must be prepared separately.
h3. Parts and consumers
# IGNITE-29208 preserves the peer address of wrapped SSL engines; [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 keeps a factory-owned context and certificate snapshot from one
store read. A factory subclass can use protected {{init()}} to load a fresh
snapshot. Callers obtain its context with {{create()}}. A failed replacement
keeps the previous context in use. [PR
#13751|https://github.com/apache/ignite/pull/13751] covers this part.
# IGNITE-29210 adds reload/status for discovery, communication, the client
connector and binary REST, with validation, per-node results, permissions and
audit. Its forwarding context lets node transports follow replacements.
# IGNITE-29211 adds opt-in renewal, retries and monitoring; the external system
still issues and supplies certificates.
# IGNITE-29212 adds HTTP REST to reload/status and, together with IGNITE-29211,
automatic HTTPS renewal.
h3. Merge and integration order
Merge IGNITE-29209, then IGNITE-29210 ([PR
#13785|https://github.com/apache/ignite/pull/13785]). IGNITE-29211 ([PR
#13786|https://github.com/apache/ignite/pull/13786]) and IGNITE-29212 ([PR
#13787|https://github.com/apache/ignite/pull/13787]) may then merge in either
order. Include the [joint integration
commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
once in the PR that merges second, after both foundations are present.
h3. Completion
Each part includes tests and user/developer documentation. Verify the combined
solution with mutual TLS, trust changes, existing configurations and automatic
HTTPS renewal, preserving configured HTTP TLS parameters.
Factory subclasses require adaptation and recompilation under IGNITE-29209;
plain {{Factory<SSLContext>}} remains supported. Transport and Jetty migration
limits belong to their owning tasks. See [factory
migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory]
and [certificate
rollout/recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
At {{f4a9191a}}, all 86 local tests in the combined SSL and HTTPS suites
passed, including automatic certificate renewal over HTTPS. Checkstyle passed.
Close the umbrella after all parts merge and combined validation passes.
was:
Allow administrators to replace node TLS certificates and trust stores without
restarting nodes. When an external system delivers certificates, let Ignite
load valid replacements automatically before the current chains expire.
Existing connections remain usable; peer trust must be prepared separately.
h3. Parts and consumers
# IGNITE-29208 preserves the peer address of wrapped SSL engines; [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 keeps a factory-owned context and certificate snapshot from one
store read. {{init()}} publishes replacements atomically and retains working
material on failure; {{create()}}/{{sslBundle()}} reuse accepted material.
Previously obtained contexts remain snapshots. [PR
#13751|https://github.com/apache/ignite/pull/13751] covers this part.
# IGNITE-29210 adds reload/status for discovery, communication, the client
connector and binary REST, with validation, per-node results, permissions and
audit. Its forwarding context lets node transports follow replacements.
# IGNITE-29211 adds opt-in renewal, retries and monitoring; the external system
still issues and supplies certificates.
# IGNITE-29212 adds HTTP REST to reload/status and, together with IGNITE-29211,
automatic HTTPS renewal.
h3. Merge and integration order
Merge IGNITE-29209, then IGNITE-29210 ([PR
#13785|https://github.com/apache/ignite/pull/13785]). IGNITE-29211 ([PR
#13786|https://github.com/apache/ignite/pull/13786]) and IGNITE-29212 ([PR
#13787|https://github.com/apache/ignite/pull/13787]) may then merge in either
order. Include the [joint integration
commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
once in the PR that merges second, after both foundations are present.
h3. Completion
Each part includes tests and user/developer documentation. Verify the combined
solution with mutual TLS, trust changes, existing configurations and automatic
HTTPS renewal, preserving configured HTTP TLS parameters.
Factory subclasses require adaptation and recompilation under IGNITE-29209;
plain {{Factory<SSLContext>}} remains supported. Transport and Jetty migration
limits belong to their owning tasks. See [factory
migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory]
and [certificate
rollout/recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
Targeted local checks passed for all prepared parts. Combined validation at
{{fe6d4afd}} passed 109 cases with two existing JMX skips and Checkstyle. This
is not full CI. Close the umbrella after all parts merge and combined
validation passes.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 7h
> Remaining Estimate: 0h
>
> Allow administrators to replace node TLS certificates and trust stores
> without restarting nodes. When an external system delivers certificates, let
> Ignite load valid replacements automatically before the current chains
> expire. Existing connections remain usable; peer trust must be prepared
> separately.
> h3. Parts and consumers
> # IGNITE-29208 preserves the peer address of wrapped SSL engines; [PR
> #13750|https://github.com/apache/ignite/pull/13750] is merged.
> # IGNITE-29209 keeps a factory-owned context and certificate snapshot from
> one store read. A factory subclass can use protected {{init()}} to load a
> fresh snapshot. Callers obtain its context with {{create()}}. A failed
> replacement keeps the previous context in use. [PR
> #13751|https://github.com/apache/ignite/pull/13751] covers this part.
> # IGNITE-29210 adds reload/status for discovery, communication, the client
> connector and binary REST, with validation, per-node results, permissions and
> audit. Its forwarding context lets node transports follow replacements.
> # IGNITE-29211 adds opt-in renewal, retries and monitoring; the external
> system still issues and supplies certificates.
> # IGNITE-29212 adds HTTP REST to reload/status and, together with
> IGNITE-29211, automatic HTTPS renewal.
> h3. Merge and integration order
> Merge IGNITE-29209, then IGNITE-29210 ([PR
> #13785|https://github.com/apache/ignite/pull/13785]). IGNITE-29211 ([PR
> #13786|https://github.com/apache/ignite/pull/13786]) and IGNITE-29212 ([PR
> #13787|https://github.com/apache/ignite/pull/13787]) may then merge in either
> order. Include the [joint integration
> commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
> once in the PR that merges second, after both foundations are present.
> h3. Completion
> Each part includes tests and user/developer documentation. Verify the
> combined solution with mutual TLS, trust changes, existing configurations and
> automatic HTTPS renewal, preserving configured HTTP TLS parameters.
> Factory subclasses require adaptation and recompilation under IGNITE-29209;
> plain {{Factory<SSLContext>}} remains supported. Transport and Jetty
> migration limits belong to their owning tasks. See [factory
> migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory]
> and [certificate
> rollout/recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
> At {{f4a9191a}}, all 86 local tests in the combined SSL and HTTPS suites
> passed, including automatic certificate renewal over HTTPS. Checkstyle
> passed. Close the umbrella after all parts merge and combined validation
> passes.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
