[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Let administrators apply replacement TLS keys and trust material on running
nodes with {{control.sh --ssl reload}}.
h3. What to deliver
# Make {{AbstractSslContextFactory.init()}} public. Calls on the same factory
run one at a time, while cached {{create()}} calls can still return the current
context. An override of {{create()}} sees a reload only if it gets the context
from {{super.create()}} on every call.
# Run the command on all server and thick-client nodes in the current topology.
Reload factories only for TCP discovery, communication, the client connector
and binary REST transports that started with TLS. Reload each factory once per
node even if multiple transports share it. Ask for confirmation unless the
operator passes {{--yes}}.
# Support {{SslContextFactory}} and {{AbstractSslContextFactory}} subclasses
whose {{createKeyManagers()}} and {{createTrustManagers()}} load current
material and whose {{create()}} returns or wraps {{super.create()}}. Ignite
calls {{create()}} for each new connection to a transport using such a factory.
Report other factory types as unsupported and retain their existing call
behavior.
# Require {{ADMIN_OPS}}. Each node logs its outcome and, when security is
enabled, the initiator. Report results by node and transport, including nodes
with no TLS. Continue after individual failures and keep successful
replacements applied. Exit with an error if a target fails, is unsupported or
leaves the topology.
# Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to add peer
trust across the cluster before rotation, replace store files at the configured
paths with the same passwords, verify the change with a new connection, and
restore the prior files and reload if needed. Trust managers supplied through
{{setTrustManagers()}} are reused.
h3. Acceptance
Verify command-driven rotation with a new connection on server and thick-client
nodes. Cover shared and custom factories, concurrent commands, mixed results,
unsupported and departed targets, the no-TLS result, confirmation, permissions
and outcome logging.
Depends on IGNITE-29256. Changing node configuration requires a restart. Verify
peer trust and certificate validity with a fresh connection after a successful
reload. A separate status command, new certificate-date checks and background
monitoring are outside this ticket.
[Implementation plan in PR #13785|https://github.com/apache/ignite/pull/13785]
was:
Let an administrator apply replacement TLS keys and trust material on running
nodes without restarting them.
h3. What to deliver
# Add {{control.sh --ssl reload}} for all server and thick-client nodes in the
current topology. Cover TCP discovery, communication, the client connector and
binary REST.
# Reload each shared factory once per node and serialize its reload requests.
During loading and after failure, new connections use the previous context;
after success, they use the replacement. Established connections stay open.
Preserve TLS settings and client authentication.
# Support the standard factory and custom subclasses following its reload
contract. Document that contract. Report other factory types as unsupported
without changing their normal behavior.
# Require {{ADMIN_OPS}}, log initiator and outcome, and return results by node
and transport. Continue after individual failures; return an error for failed,
unsupported or departed targets. Successful replacements remain applied. Nodes
without TLS need no action.
# Document source replacement, trust preparation, verification with a new
connection and recovery by restoring material and reloading.
h3. Acceptance
Verify all four transports, key and trust rotation, loading failures, existing
and new connections, shared/custom factories, concurrent requests, partial
results, permissions and audit.
Depends on IGNITE-29209. Keep existing loading checks and startup behavior. No
status command, new certificate-date policy or background metrics. Changing
node configuration still requires a restart; local loading success does not
prove peer trust or certificate validity.
[Implementation plan: PR #13785|https://github.com/apache/ignite/pull/13785]
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Let administrators apply replacement TLS keys and trust material on running
> nodes with {{control.sh --ssl reload}}.
> h3. What to deliver
> # Make {{AbstractSslContextFactory.init()}} public. Calls on the same factory
> run one at a time, while cached {{create()}} calls can still return the
> current context. An override of {{create()}} sees a reload only if it gets
> the context from {{super.create()}} on every call.
> # Run the command on all server and thick-client nodes in the current
> topology. Reload factories only for TCP discovery, communication, the client
> connector and binary REST transports that started with TLS. Reload each
> factory once per node even if multiple transports share it. Ask for
> confirmation unless the operator passes {{--yes}}.
> # Support {{SslContextFactory}} and {{AbstractSslContextFactory}} subclasses
> whose {{createKeyManagers()}} and {{createTrustManagers()}} load current
> material and whose {{create()}} returns or wraps {{super.create()}}. Ignite
> calls {{create()}} for each new connection to a transport using such a
> factory. Report other factory types as unsupported and retain their existing
> call behavior.
> # Require {{ADMIN_OPS}}. Each node logs its outcome and, when security is
> enabled, the initiator. Report results by node and transport, including nodes
> with no TLS. Continue after individual failures and keep successful
> replacements applied. Exit with an error if a target fails, is unsupported or
> leaves the topology.
> # Update “Upgrading Certificates” in the SSL/TLS guide. Explain how to add
> peer trust across the cluster before rotation, replace store files at the
> configured paths with the same passwords, verify the change with a new
> connection, and restore the prior files and reload if needed. Trust managers
> supplied through {{setTrustManagers()}} are reused.
> h3. Acceptance
> Verify command-driven rotation with a new connection on server and
> thick-client nodes. Cover shared and custom factories, concurrent commands,
> mixed results, unsupported and departed targets, the no-TLS result,
> confirmation, permissions and outcome logging.
> Depends on IGNITE-29256. Changing node configuration requires a restart.
> Verify peer trust and certificate validity with a fresh connection after a
> successful reload. A separate status command, new certificate-date checks and
> background monitoring are outside this ticket.
> [Implementation plan in PR #13785|https://github.com/apache/ignite/pull/13785]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
