hanicz opened a new pull request, #1492: URL: https://github.com/apache/knox/pull/1492
(It is very **important** that you created an Apache Knox JIRA for this change and that the PR title/commit message includes the Apache Knox JIRA ID!) [KNOX-3552](https://issues.apache.org/jira/browse/KNOX-3552) - Improve image startup time ## What changes were proposed in this pull request? - **Bundled truststores:** The Dockerfile now downloads all default certs at build time and pre-builds them into two PKCS12 stores, `/home/knox/cacrts/default-trust.p12` and `letsencrypt-staging-trust.p12`. The entrypoint imports each with a single `keytool -importkeystore`. Alias names, `TRUSTSTORE_IMPORTS` and `IMPORT_LETS_ENCRYPT_STAGING_CERTS` behave as before. - The bundled stores use the password `changeit` (`KNOX_DEFAULT_TRUSTSTORE_PASSWORD`). They hold public root CA certificates only, so there is nothing secret to protect. The gateway's runtime truststore that the certs are imported into is still protected by `ALIAS_PASSPHRASE` (keystore password file / master secret), unchanged. - **Fewer `keytool` runs:** `keytool -delete` is skipped when the truststore doesn't exist yet (first start). - **Batched aliases:** `saveAlias` queues aliases and they are created with one `knoxcli.sh create-aliases` call. - **Download timeouts:** all cert downloads now have curl timeouts. **Trade-off:** the Let's Encrypt staging roots are now downloaded when the image is built, not when the container starts. - Downside: picking up a changed cert now needs a new image instead of a container restart. - Upside: the container no longer needs internet access at startup, startup doesn't depend on letsencrypt.org being reachable, and every container from the same image gets the same truststore. Before, a failed or slow download either stalled startup (curl had no timeout) or silently skipped the certs. ## How was this patch tested? Built the image from `knox-3.1.0-SNAPSHOT.zip`, before and after the change, and compared: - Startup at `--cpus=1`: entrypoint 15s → 7s, until "Started gateway" 29s → 21s. - Default run: the truststore has the same type (PKCS12) and the same 13 aliases as before. - `docker restart`: still 13 aliases, no errors. - `IMPORT_LETS_ENCRYPT_STAGING_CERTS=false`: the 6 production roots only. - Custom `TRUSTSTORE_IMPORTS` plus `CA_FILE`: custom and CA certs plus staging roots, same as before. - DB/LDAP alias env vars: aliases created in one `knoxcli` call (`knoxcli.sh list-alias`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
