[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Allow administrators to reload TLS keys and trust material on all server and
thick-client nodes in the current topology with {{control.sh --ssl reload}},
without restarting nodes.
h3. Behavior
* Cover TCP discovery, communication, the client connector and binary REST. Use
IGNITE-29209's factory reload operation and existing context cache. Reload a
shared factory once per node; node-managed loads of the same factory must not
overlap.
* New connections use the replacement after successful loading. During loading
or after failure they use the previous context. Keep established connections
open and preserve TLS settings and client authentication.
* Require {{ADMIN_OPS}} and log the initiator and outcome. Report results by
node and transport. Continue after a failure, returning an error for failed,
unsupported or departed targets. Successful replacements remain applied. Nodes
without TLS need no action.
h3. Scope
Support {{SslContextFactory}} and {{AbstractSslContextFactory}} subclasses that
use the base context cache and loading hooks. Other factories keep their
current behavior and are reported as unsupported by reload. Reread configured
sources; changing node configuration requires a restart.
Keep existing loading checks and startup behavior. Certificate timing and
background monitoring belong to IGNITE-29211; HTTP REST belongs to
IGNITE-29212. No separate {{--ssl status}} command is required.
h3. Acceptance
Test key and trust rotation on all four transports, old and new connections
during loading and after failure, shared factories, custom loaders, overlapping
requests, partial results, permissions and audit.
Document trust preparation, verification with a new connection and recovery by
restoring material and reloading. Successful local loading does not prove peer
trust or certificate validity.
[PR #13785|https://github.com/apache/ignite/pull/13785]
was:
Allow administrators to reload TLS certificates and trust material on all
server and thick-client nodes in the current topology with {{control.sh --ssl
reload}}, without restarting nodes or closing established connections.
h3. Behavior
* Cover TCP discovery, communication, the client connector and binary REST.
Reload each shared factory once per node, using {{init()}} from IGNITE-29209
and the existing context cache. Reloads of the same factory must not overlap.
* New connections use the replacement after successful loading. During loading,
or if it fails, they continue using the previous context. Preserve existing TLS
settings and client authentication.
* Require {{ADMIN_OPS}} and log the initiator and outcome. Report results by
node and transport; continue after individual failures and return an error for
failed, unsupported or unavailable targets. Report selected nodes that leave
the topology as unavailable. Successful replacements remain applied after a
partial failure. Nodes without TLS need no action.
h3. Scope
Support {{SslContextFactory}} and subclasses using the base context lifecycle,
including custom key and trust loaders. Other factories retain their current
behavior; the command reports that reload is unsupported. Reread the configured
sources; changing node configuration still requires a restart.
Keep existing loading checks and startup behavior. Separate {{--ssl status}},
certificate metadata, additional certificate-date checks, automatic renewal and
HTTP REST are outside this ticket. Monitoring of background renewal belongs to
IGNITE-29211.
h3. Acceptance
Test certificate and trust replacement on all four transports, old and new
connections, failed loading, shared factories, custom loading hooks, partial
failures and permissions.
Document trust preparation and verification with a new TLS connection:
successful local loading does not prove that peers accept the certificate. If
verification fails, restore the previous material and reload.
Depends on IGNITE-29209. [PR
#13785|https://github.com/apache/ignite/pull/13785].
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Allow administrators to reload TLS keys and trust material on all server and
> thick-client nodes in the current topology with {{control.sh --ssl reload}},
> without restarting nodes.
> h3. Behavior
> * Cover TCP discovery, communication, the client connector and binary REST.
> Use IGNITE-29209's factory reload operation and existing context cache.
> Reload a shared factory once per node; node-managed loads of the same factory
> must not overlap.
> * New connections use the replacement after successful loading. During
> loading or after failure they use the previous context. Keep established
> connections open and preserve TLS settings and client authentication.
> * Require {{ADMIN_OPS}} and log the initiator and outcome. Report results by
> node and transport. Continue after a failure, returning an error for failed,
> unsupported or departed targets. Successful replacements remain applied.
> Nodes without TLS need no action.
> h3. Scope
> Support {{SslContextFactory}} and {{AbstractSslContextFactory}} subclasses
> that use the base context cache and loading hooks. Other factories keep their
> current behavior and are reported as unsupported by reload. Reread configured
> sources; changing node configuration requires a restart.
> Keep existing loading checks and startup behavior. Certificate timing and
> background monitoring belong to IGNITE-29211; HTTP REST belongs to
> IGNITE-29212. No separate {{--ssl status}} command is required.
> h3. Acceptance
> Test key and trust rotation on all four transports, old and new connections
> during loading and after failure, shared factories, custom loaders,
> overlapping requests, partial results, permissions and audit.
> Document trust preparation, verification with a new connection and recovery
> by restoring material and reloading. Successful local loading does not prove
> peer trust or certificate validity.
> [PR #13785|https://github.com/apache/ignite/pull/13785]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
