[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
Extend manual TLS reload to HTTPS so HTTP REST certificates and trust can be
replaced without restarting nodes.
h3. What to deliver
# Allow factory-managed HTTPS on the built-in HTTP connector and compatible
HTTP connectors defined in Jetty XML. Include HTTP REST in the reload command
and its results, using IGNITE-29210's factory support rules.
# Apply replacements to new connections, preserve established connections and
retain the previous context after failed loading.
# Support requiring a trusted client certificate. Preserve configured Jetty
protocol, cipher and Host/SNI checks.
# Keep existing XML-managed HTTPS unchanged and outside the reload command.
Reject conflicting TLS configuration without falling back to plaintext;
document migration and its restart requirement.
# Start, stop and reload a shared factory once per node, including when HTTP
and binary REST share it.
h3. Acceptance
Verify key/trust rotation, mutual TLS, established connections, failures,
shared lifecycle and both connector configuration paths.
Depends on IGNITE-29210. Can merge independently of IGNITE-29211. Whichever
merges second must verify scheduled HTTPS rotation, established-connection
continuity and the combined documentation. No separate status command or new
renewal mechanism.
[Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
was:
With {{ConnectorConfiguration.httpSslFactory}}, {{control.sh --ssl reload}}
loads new certificates and trust stores for HTTP REST. New HTTPS connections
use the new certificates. Established connections stay open, and a failed
reload keeps the existing material.
{{--ssl status}} lists them under HTTP REST.
h3. Result
* Support the built-in HTTP connector and connectors from Jetty XML. Jetty
applies its default exclusions to the factory's protocols and cipher suites.
With {{httpSslClientAuth=true}}, new connections require a trusted client
certificate.
* A node running HTTP REST fails to start if {{httpSslClientAuth}} is enabled
without {{httpSslFactory}}, or if a connector using that factory already
configures TLS or a default protocol other than HTTP.
* With {{httpSslFactory}}, HTTP REST accepts a Host header absent from the
certificate by default. An explicit Jetty {{SecureRequestCustomizer}} keeps its
Host check. TLS configured in Jetty XML remains outside Ignite's reload and
status commands. Moving TLS from XML to the factory requires a rolling restart.
[HTTPS migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload].
* The node starts and stops a {{LifecycleAware}} {{httpSslFactory}} once, even
when binary REST shares it.
Builds on IGNITE-29210. Code and validation are in [PR
#13787|https://github.com/apache/ignite/pull/13787]. Once both this task and
IGNITE-29211 are present, include the [joint HTTPS renewal test and
documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
once in the PR merged second.
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Extend manual TLS reload to HTTPS so HTTP REST certificates and trust can be
> replaced without restarting nodes.
> h3. What to deliver
> # Allow factory-managed HTTPS on the built-in HTTP connector and compatible
> HTTP connectors defined in Jetty XML. Include HTTP REST in the reload command
> and its results, using IGNITE-29210's factory support rules.
> # Apply replacements to new connections, preserve established connections and
> retain the previous context after failed loading.
> # Support requiring a trusted client certificate. Preserve configured Jetty
> protocol, cipher and Host/SNI checks.
> # Keep existing XML-managed HTTPS unchanged and outside the reload command.
> Reject conflicting TLS configuration without falling back to plaintext;
> document migration and its restart requirement.
> # Start, stop and reload a shared factory once per node, including when HTTP
> and binary REST share it.
> h3. Acceptance
> Verify key/trust rotation, mutual TLS, established connections, failures,
> shared lifecycle and both connector configuration paths.
> Depends on IGNITE-29210. Can merge independently of IGNITE-29211. Whichever
> merges second must verify scheduled HTTPS rotation, established-connection
> continuity and the combined documentation. No separate status command or new
> renewal mechanism.
> [Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
