[
https://issues.apache.org/jira/browse/KNOX-3552?focusedWorklogId=1052772&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052772
]
ASF GitHub Bot logged work on KNOX-3552:
----------------------------------------
Author: ASF GitHub Bot
Created on: 05/Nov/26 15:49
Start Date: 05/Nov/26 15:49
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1492:
URL: https://github.com/apache/knox/pull/1492
(It is very **important** that you created an Apache Knox JIRA for this
change and that the PR title/commit message includes the Apache Knox JIRA ID!)
[KNOX-3552](https://issues.apache.org/jira/browse/KNOX-3552) - Improve image
startup time
## What changes were proposed in this pull request?
- **Bundled truststores:** The Dockerfile now downloads all default certs at
build time and pre-builds them into two PKCS12 stores,
`/home/knox/cacrts/default-trust.p12` and `letsencrypt-staging-trust.p12`. The
entrypoint imports each with a single `keytool -importkeystore`. Alias names,
`TRUSTSTORE_IMPORTS` and `IMPORT_LETS_ENCRYPT_STAGING_CERTS` behave as before.
- The bundled stores use the password `changeit`
(`KNOX_DEFAULT_TRUSTSTORE_PASSWORD`). They hold public root CA certificates
only, so there is nothing secret to protect. The gateway's runtime truststore
that the certs are imported into is still protected by `ALIAS_PASSPHRASE`
(keystore password file / master secret), unchanged.
- **Fewer `keytool` runs:** `keytool -delete` is skipped when the truststore
doesn't exist yet (first start).
- **Batched aliases:** `saveAlias` queues aliases and they are created with
one `knoxcli.sh create-aliases` call.
- **Download timeouts:** all cert downloads now have curl timeouts.
**Trade-off:** the Let's Encrypt staging roots are now downloaded when the
image is built, not when the container starts.
- Downside: picking up a changed cert now needs a new image instead of a
container restart.
- Upside: the container no longer needs internet access at startup, startup
doesn't depend on letsencrypt.org being reachable, and every container from the
same image gets the same truststore. Before, a failed or slow download either
stalled startup (curl had no timeout) or silently skipped the certs.
## How was this patch tested?
Built the image from `knox-3.1.0-SNAPSHOT.zip`, before and after the change,
and compared:
- Startup at `--cpus=1`: entrypoint 15s → 7s, until "Started gateway" 29s →
21s.
- Default run: the truststore has the same type (PKCS12) and the same 13
aliases as before.
- `docker restart`: still 13 aliases, no errors.
- `IMPORT_LETS_ENCRYPT_STAGING_CERTS=false`: the 6 production roots only.
- Custom `TRUSTSTORE_IMPORTS` plus `CA_FILE`: custom and CA certs plus
staging roots, same as before.
- DB/LDAP alias env vars: aliases created in one `knoxcli` call (`knoxcli.sh
list-alias`).
Issue Time Tracking
-------------------
Worklog Id: (was: 1052772)
Remaining Estimate: 0h
Time Spent: 10m
> Improve image startup time
> --------------------------
>
> Key: KNOX-3552
> URL: https://issues.apache.org/jira/browse/KNOX-3552
> Project: Apache Knox
> Issue Type: Task
> Components: docker
> Affects Versions: 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
