[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Rotate TLS certificates and trust on running nodes without closing established
connections. An external source supplies the material; Ignite loads it on
command or, when enabled, before expiry.
h3. Deliverables
# IGNITE-29208: preserve peer information on wrapped SSL engines. Already
merged in [PR #13750|https://github.com/apache/ignite/pull/13750].
# IGNITE-29209: let a factory explicitly reload its material while preserving
existing cached creation behavior.
# IGNITE-29210: provide authorized manual reload for the four TCP transports,
per-node results and audit.
# IGNITE-29211: add automatic renewal, necessary expiry checks, retries and
failure monitoring.
# IGNITE-29212: extend the same operation to HTTPS, preserving existing Jetty
TLS behavior.
h3. Order and completeness
Merge IGNITE-29209 before IGNITE-29210. Renewal and HTTP can follow in either
order. The ticket merged second includes the combined HTTPS renewal test and
documentation. Refresh dependent PRs after each prerequisite merges; their
diffs must contain only their remaining changes.
Each ticket defines its required results and acceptance checks. Its PR explains
the implementation and records verification. Confirm key/trust rotation on all
supported transports, automatic renewal, established connections, failure
recovery and monitoring.
Certificate issuance, live node reconfiguration, a separate status command,
certificate inventory and universal support for arbitrary factories are outside
this scope. Local loading success alone does not establish peer trust.
was:
Administrators can replace TLS certificates and trust stores on running nodes.
Another system delivers the certificates. With automatic renewal, a node can
load a replacement before the earliest chain expires. Existing connections stay
open.
h3. Scope and merge order
# IGNITE-29208 preserves the peer address on wrapped SSL engines. [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 adds the protected {{init()}} method for replacing a factory’s
cached SSL context. IGNITE-29210 uses it for the reload command and adds status
reporting.
# IGNITE-29211 adds scheduled renewal and retries. IGNITE-29212 extends the
commands to HTTP REST. These two parts can merge in either order after
IGNITE-29210.
After each prerequisite is squash-merged, update the dependent branches and
verify that each PR diff against master contains only its remaining changes.
Once both HTTP and renewal are present, include the [joint HTTPS renewal test
and
documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
once in the PR merged second.
h3. Completion
Verify rotation on new mutual TLS and HTTPS connections, continuity of
established connections, and recovery after an invalid replacement. Each PR
records its checks. See the [rollout
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
for the order of peer trust and certificate updates.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 7h
> Remaining Estimate: 0h
>
> Rotate TLS certificates and trust on running nodes without closing
> established connections. An external source supplies the material; Ignite
> loads it on command or, when enabled, before expiry.
> h3. Deliverables
> # IGNITE-29208: preserve peer information on wrapped SSL engines. Already
> merged in [PR #13750|https://github.com/apache/ignite/pull/13750].
> # IGNITE-29209: let a factory explicitly reload its material while preserving
> existing cached creation behavior.
> # IGNITE-29210: provide authorized manual reload for the four TCP transports,
> per-node results and audit.
> # IGNITE-29211: add automatic renewal, necessary expiry checks, retries and
> failure monitoring.
> # IGNITE-29212: extend the same operation to HTTPS, preserving existing Jetty
> TLS behavior.
> h3. Order and completeness
> Merge IGNITE-29209 before IGNITE-29210. Renewal and HTTP can follow in either
> order. The ticket merged second includes the combined HTTPS renewal test and
> documentation. Refresh dependent PRs after each prerequisite merges; their
> diffs must contain only their remaining changes.
> Each ticket defines its required results and acceptance checks. Its PR
> explains the implementation and records verification. Confirm key/trust
> rotation on all supported transports, automatic renewal, established
> connections, failure recovery and monitoring.
> Certificate issuance, live node reconfiguration, a separate status command,
> certificate inventory and universal support for arbitrary factories are
> outside this scope. Local loading success alone does not establish peer trust.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
