[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
HTTP REST can already serve HTTPS configured in Jetty XML, but that setup is
outside Ignite's reload and renewal. The existing TLS properties in
{{ConnectorConfiguration}} apply to binary REST. Add a separate SSL factory
setting for HTTP REST so it can use the same reload command and renewal
schedule as TCP transports.
h3. Add factory-managed HTTPS
# Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the built-in
HTTP connector or a Jetty XML connector whose default protocol is HTTP and
which has no TLS of its own. Add {{httpSslClientAuth}} to require a trusted
client certificate.
# Apply the factory's exact enabled protocols and cipher suites; do not let
Jetty's default exclusions silently narrow them. Keep configured Jetty Host and
SNI checks. Without an explicit secure request customizer, Jetty checks the
request Host against the server certificate, so the server host name or IP
address used by clients must match it.
# When HTTP REST starts, reject a configured factory if the connector already
defines TLS or its default protocol is not HTTP. Also reject
{{httpSslClientAuth}} without {{httpSslFactory}}. These errors must fail node
startup before the connector can serve plaintext HTTP.
h3. Join the existing reload mechanism
# Once factory-managed HTTPS starts, include HTTP REST in reload results.
Schedule renewal if its factory supports it and renewal is enabled, as defined
in IGNITE-29211. A factory that does not extend {{AbstractSslContextFactory}}
can supply the startup context, but reload must report it as unsupported.
# During loading and after failure, new connections use the previous context.
After success they use the replacement; established connections stay open. Use
the same guarantees for manual reload and automatic renewal.
# Start and stop a {{LifecycleAware}} factory once per node, including when
HTTP and binary REST share it.
Keep HTTPS configured directly in Jetty XML unchanged and outside reload and
its results. Document the new settings and how to migrate that setup to a
factory with a restart. Add HTTPS to the reload and renewal instructions from
IGNITE-29210 and IGNITE-29211.
h3. Done when
Verify key and trust rotation, mutual TLS, exact TLS settings, Host checks,
failed reload, established connections and shared-factory lifecycle. Cover both
supported connector configurations and unchanged HTTPS configured directly in
Jetty XML. Rejected configurations must never serve plaintext HTTP; reload must
list only factory-managed HTTPS that actually started. Include a
scheduled-renewal test showing that a new HTTPS connection uses the replacement
while an established connection stays usable.
Depends on IGNITE-29211. This ticket completes HTTP integration of the existing
command and scheduler.
[Implementation plan in PR #13787|https://github.com/apache/ignite/pull/13787]
was:
Let administrators use an SSL context factory for HTTPS on HTTP REST. They can
then replace certificates and trust on running nodes.
h3. Configuration
# Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the built-in
connector. It also works on a Jetty XML connector that uses HTTP as its default
protocol and has no TLS of its own. Add {{httpSslClientAuth}} to require a
trusted client certificate.
# Use the factory's exact set of enabled protocols and cipher suites. Jetty's
default exclusions do not apply to this connector. Keep configured Jetty Host
and SNI checks. Without an explicit secure request customizer, Jetty checks the
Host against the server certificate. The host name or IP address that clients
use must match.
# Keep HTTPS configured directly in Jetty XML as it is and leave it out of
reload and its results. When HTTP REST starts, reject a configured factory if
the connector already defines TLS or has a default protocol other than HTTP.
Also reject {{httpSslClientAuth}} without {{httpSslFactory}}. Fail node startup
before the HTTP connector serves plaintext.
# Document HTTPS setup and how to move from TLS configured directly in Jetty
XML. The move requires a restart.
h3. Reload and renewal
# Include HTTP REST in the reload command and results once factory-managed
HTTPS starts. A factory that does not extend {{AbstractSslContextFactory}}
supplies the startup context. The command reports it as unsupported.
# During loading and after a failed load, new connections use the previous
context. After success, new connections use the replacement. Established
connections stay open.
# Start and stop a {{LifecycleAware}} factory once per node, even when HTTP and
binary REST share it. Use the same reload and automatic renewal as the other
transports.
h3. Acceptance
Verify key and trust rotation, mutual TLS, exact protocol and cipher settings,
Host checks, failed reload, established connections and shared-factory
lifecycle. Test the built-in connector and the XML connector. Check that HTTPS
configured directly in Jetty XML keeps working as before, rejected
configurations never serve plaintext HTTP, and reload lists only
factory-managed HTTPS that started.
Depends on IGNITE-29211. Include a test that shows scheduled renewal on a new
HTTPS connection while an established connection stays usable. Add HTTPS to the
reload and renewal documentation from IGNITE-29210 and IGNITE-29211.
[Implementation plan in PR #13787|https://github.com/apache/ignite/pull/13787]
> Configure HTTPS for HTTP REST with a reloadable SSL context factory
> -------------------------------------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> HTTP REST can already serve HTTPS configured in Jetty XML, but that setup is
> outside Ignite's reload and renewal. The existing TLS properties in
> {{ConnectorConfiguration}} apply to binary REST. Add a separate SSL factory
> setting for HTTP REST so it can use the same reload command and renewal
> schedule as TCP transports.
> h3. Add factory-managed HTTPS
> # Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the
> built-in HTTP connector or a Jetty XML connector whose default protocol is
> HTTP and which has no TLS of its own. Add {{httpSslClientAuth}} to require a
> trusted client certificate.
> # Apply the factory's exact enabled protocols and cipher suites; do not let
> Jetty's default exclusions silently narrow them. Keep configured Jetty Host
> and SNI checks. Without an explicit secure request customizer, Jetty checks
> the request Host against the server certificate, so the server host name or
> IP address used by clients must match it.
> # When HTTP REST starts, reject a configured factory if the connector already
> defines TLS or its default protocol is not HTTP. Also reject
> {{httpSslClientAuth}} without {{httpSslFactory}}. These errors must fail node
> startup before the connector can serve plaintext HTTP.
> h3. Join the existing reload mechanism
> # Once factory-managed HTTPS starts, include HTTP REST in reload results.
> Schedule renewal if its factory supports it and renewal is enabled, as
> defined in IGNITE-29211. A factory that does not extend
> {{AbstractSslContextFactory}} can supply the startup context, but reload must
> report it as unsupported.
> # During loading and after failure, new connections use the previous context.
> After success they use the replacement; established connections stay open.
> Use the same guarantees for manual reload and automatic renewal.
> # Start and stop a {{LifecycleAware}} factory once per node, including when
> HTTP and binary REST share it.
> Keep HTTPS configured directly in Jetty XML unchanged and outside reload and
> its results. Document the new settings and how to migrate that setup to a
> factory with a restart. Add HTTPS to the reload and renewal instructions from
> IGNITE-29210 and IGNITE-29211.
> h3. Done when
> Verify key and trust rotation, mutual TLS, exact TLS settings, Host checks,
> failed reload, established connections and shared-factory lifecycle. Cover
> both supported connector configurations and unchanged HTTPS configured
> directly in Jetty XML. Rejected configurations must never serve plaintext
> HTTP; reload must list only factory-managed HTTPS that actually started.
> Include a scheduled-renewal test showing that a new HTTPS connection uses the
> replacement while an established connection stays usable.
> Depends on IGNITE-29211. This ticket completes HTTP integration of the
> existing command and scheduler.
> [Implementation plan in PR #13787|https://github.com/apache/ignite/pull/13787]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
