[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137781#comment-18137781
]
Anton Vinogradov commented on IGNITE-29212:
-------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13787] verdict for PR
13787 · RunAll build [9469495|https://ci2.ignite.apache.org/build/9469495] ·
tested
[838fbf3|https://github.com/apache/ignite/pull/13787/commits/838fbf31341479bc8f82ad31a5bf8f5e4adcba9c]
· 149 suites ran, 0 reused
(!) *This run doesn't cover the PR fully:*
- 1 suite ran fewer tests than the same suite on master
Everything below is what it did manage to say.
(?) *1 suite ran fewer tests than on master* (tests that never ran can't fail):
- PDS 3: ran 45 of master's 52 tests (*-13%*)
(?) *No blockers found — but the run above can't prove the PR is clean.* 24
failing tests are not blamed on this PR. Re-run after you handle what is listed
above.
_What each label means and what to do: [verdict
glossary|https://github.com/anton-vinogradov/ignite-pr-checker/blob/main/docs/features.md#verdict-glossary]._
♻️ Settled after 1 auto re-run wave: #1 — 4 suites that failed mid-run.
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Let HTTP REST use the same certificate reload and status workflow as other
> node transports. {{ConnectorConfiguration.httpSslFactory}} allows HTTPS
> certificate and trust-store rotation without restarting the connector. With
> IGNITE-29211, the same factory can also renew certificates automatically.
> h3. Result and acceptance
> * Support built-in and XML-supplied Jetty HTTP connectors. New HTTPS
> connections use replacement material, established connections remain usable,
> and failed reloads retain the working context.
> * Preserve factory protocols/cipher suites, applicable Jetty cipher
> exclusions and explicitly configured {{SecureRequestCustomizer}} settings.
> * {{httpSslClientAuth=true}} requires {{httpSslFactory}} and a trusted client
> certificate before and after certificate/trust changes. Reject a managed
> factory combined with the connector's own TLS configuration or PROXY protocol.
> * Keep existing Jetty-owned TLS working when {{httpSslFactory}} is absent.
> Verify real HTTPS connections, mutual TLS, XML connectors and rejected
> startup configurations.
> h3. Migration boundaries
> Moving TLS ownership from Jetty XML requires a rolling restart. Client
> authentication, host/SNI checks and revocation policy must be preserved
> explicitly; settings are not all transferred automatically.
> The standard Ignite factory has no key-alias selector: preserve a selected
> alias with a store containing only that key and matching key/store passwords.
> {{httpSslClientAuth}} does not represent optional {{wantClientAuth}}; use a
> custom factory or retain Jetty TLS. Reproduce Jetty CRL/OCSP checks through
> suitable trust managers or retain Jetty TLS. Explicitly configured
> {{trustManagers}} remain in use; peer trust remains an operator
> responsibility.
> See [Jetty XML
> migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload],
> including implicit {{SecureRequestCustomizer}} host checks, and the
> [ConnectorConfiguration
> contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/modules/core/src/main/java/org/apache/ignite/configuration/ConnectorConfiguration.java#L528].
> h3. Delivery and automatic renewal
> Depends on IGNITE-29210 and works independently of IGNITE-29211. Once both
> renewal and HTTP are present, include the [joint integration
> commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
> once in the PR that merges second; it adds HTTPS renewal coverage and
> documentation.
> Local checks: all 9 HTTP cases and Checkstyle passed at {{271ff0ed}};
> combined HTTPS renewal passed at {{fe6d4afd}}. This is not full CI.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
