[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Allow administrators to replace TLS certificates and trust stores without
restarting nodes. Support automatic renewal when an external system supplies
new certificates.
h3. Review and merge plan
All five subtasks are created. The implementation is split into separate
branches.
# IGNITE-29208 — Preserve the peer address in SSLContextWrapper. [PR
#13750|https://github.com/apache/ignite/pull/13750] is open. This is an
independent bug fix.
# IGNITE-29209 — Add fresh SSL context creation and certificate metadata while
preserving existing factory hooks. [PR
#13751|https://github.com/apache/ignite/pull/13751] is open.
# IGNITE-29210 — Add manual reload and status for discovery, communication, the
client connector and binary REST, with authorization and audit. The branch is
prepared. Open its PR after IGNITE-29209 is merged.
# IGNITE-29211 — Add automatic renewal, retries and
ssl.ConsecutiveRenewalFailures. The branch is prepared. Open its PR after
IGNITE-29210 is merged.
# IGNITE-29212 — Add HTTP REST reload and instructions for migrating TLS from
Jetty XML. The branch is prepared. Open its PR after IGNITE-29210 is merged.
Review and merge the peer-address fix first because it touches the same wrapper
as the API change. The API branch also preserves peer addresses, so it works on
its own. Automatic renewal and HTTP REST are independent and may merge in
either order.
When both follow-ups are present, include the HTTP REST automatic-renewal
documentation and Javadoc with whichever change merges second.
h3. Completion criteria
Each PR must include its tests and documentation and pass CI on its current
head. After the prerequisites merge, update dependent branches so their PRs
show only their own changes.
Keep one context per factory instance. Transports sharing a factory reload
together. Reload checks available certificate metadata and supported TLS
settings. Administrators remain responsible for peer trust and testing new
connections.
Close this umbrella after all five parts are merged and the combined solution
passes the SSL tests, including mutual TLS and compatibility with existing
configurations.
The original [PR #13335|https://github.com/apache/ignite/pull/13335] remains
the reference implementation until the split is merged.
was:
Allow administrators to replace TLS certificates and trust stores without
restarting the cluster, and support automatic renewal when certificates are
supplied by an external system.
The implementation in PR #13335 is being split into smaller changes for review
and merge. Keep that branch as the reference while the subtasks are extracted.
Each subtask must include its tests and documentation and work when merged on
its own prerequisites.
Planned merge order:
# IGNITE-29208 — Preserve SSLEngine peer host and port in SSLContextWrapper.
Independent bug fix.
# IGNITE-29209 — Add fresh SSL context creation and certificate metadata,
preserving the existing factory hooks.
# IGNITE-29210 — Deliver manual reload and status for discovery, communication,
the client connector, and binary REST, with authorization and audit.
# IGNITE-29211 — Add automatic renewal, retries after expiry, and the single
node metric ssl.ConsecutiveRenewalFailures.
# IGNITE-29212 — Add HTTP REST integration and migration from Jetty XML.
IGNITE-29209 is required by IGNITE-29210. Automatic renewal and HTTP REST both
require IGNITE-29210, but are independent of each other. The peer-address fix
is first in the merge order because it touches the same wrapper, not because
the later features require it.
Keep the design based on one context per factory instance. Transports sharing a
factory reload together. Reload validates available certificate metadata and
supported TLS settings, but does not test connections or peer trust.
Certificate rollout and verification remain the administrator's responsibility.
Close this umbrella after all parts are merged and the assembled solution
passes the relevant SSL tests, including mutual TLS and compatibility with
existing configurations. Include test helpers and documentation with the
feature that needs them.
Reference implementation: https://github.com/apache/ignite/pull/13335
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 6h 50m
> Remaining Estimate: 0h
>
> Allow administrators to replace TLS certificates and trust stores without
> restarting nodes. Support automatic renewal when an external system supplies
> new certificates.
> h3. Review and merge plan
> All five subtasks are created. The implementation is split into separate
> branches.
> # IGNITE-29208 — Preserve the peer address in SSLContextWrapper. [PR
> #13750|https://github.com/apache/ignite/pull/13750] is open. This is an
> independent bug fix.
> # IGNITE-29209 — Add fresh SSL context creation and certificate metadata
> while preserving existing factory hooks. [PR
> #13751|https://github.com/apache/ignite/pull/13751] is open.
> # IGNITE-29210 — Add manual reload and status for discovery, communication,
> the client connector and binary REST, with authorization and audit. The
> branch is prepared. Open its PR after IGNITE-29209 is merged.
> # IGNITE-29211 — Add automatic renewal, retries and
> ssl.ConsecutiveRenewalFailures. The branch is prepared. Open its PR after
> IGNITE-29210 is merged.
> # IGNITE-29212 — Add HTTP REST reload and instructions for migrating TLS from
> Jetty XML. The branch is prepared. Open its PR after IGNITE-29210 is merged.
> Review and merge the peer-address fix first because it touches the same
> wrapper as the API change. The API branch also preserves peer addresses, so
> it works on its own. Automatic renewal and HTTP REST are independent and may
> merge in either order.
> When both follow-ups are present, include the HTTP REST automatic-renewal
> documentation and Javadoc with whichever change merges second.
> h3. Completion criteria
> Each PR must include its tests and documentation and pass CI on its current
> head. After the prerequisites merge, update dependent branches so their PRs
> show only their own changes.
> Keep one context per factory instance. Transports sharing a factory reload
> together. Reload checks available certificate metadata and supported TLS
> settings. Administrators remain responsible for peer trust and testing new
> connections.
> Close this umbrella after all five parts are merged and the combined solution
> passes the SSL tests, including mutual TLS and compatibility with existing
> configurations.
> The original [PR #13335|https://github.com/apache/ignite/pull/13335] remains
> the reference implementation until the split is merged.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
