[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
{{AbstractSslContextFactory}} already loads keys and trust, applies TLS
settings and caches the resulting context. It has no reload operation for
subclasses that keeps the working context available during loading. Clearing
the cache forces another load, but a load failure then leaves {{create()}}
unable to return the previous context.
Add an explicit reload operation for subclasses. This is the factory-level
prerequisite for IGNITE-29256 and the running-node command in IGNITE-29210.
h3. What to change
# Add {{protected final void init()}} to rebuild the context from the factory's
current settings, keys and trust. Replace the cache only after the new context
is ready.
# After success, the base {{create()}} returns the replacement. If loading
fails, throw the error and keep the previous context. Do not change contexts
already returned to callers.
# Preserve the normal cache behavior of {{create()}}, the existing key and
trust loading hooks and the protected cache field.
h3. Compatibility
Subclasses with their own no-argument {{init()}} must rename it and recompile:
the new method is final.
h3. Done when
Tests show that a successful reload replaces an already cached context and a
failed reload preserves it.
Only the factory operation belongs here. Transport integration, the public
command, certificate-date checks and scheduling follow in later tickets.
[Implementation and checks in PR
#13751|https://github.com/apache/ignite/pull/13751]
was:
Let an SSL context factory subclass replace its cached context with one built
from its current settings, keys and trust. IGNITE-29256 and IGNITE-29210 use
this operation to support reload on running nodes.
h3. What to deliver
# Give subclasses an explicit {{init()}} operation. After a successful reload,
the base {{create()}} returns the replacement. If loading fails, throw the
error and keep the previous context. Contexts already returned keep their
settings and material.
# Keep the usual cache behavior of {{create()}}, the existing key and trust
loading hooks, and the protected cache field.
# Tell reviewers in the PR that subclasses with their own no-argument
{{init()}} must rename it.
h3. Acceptance
After the factory has returned a context, verify that a successful reload
replaces it and a failed load preserves it.
Later tickets cover transport changes, running-node commands, certificate dates
and scheduling.
[Implementation and checks in PR
#13751|https://github.com/apache/ignite/pull/13751]
> Allow SSL context factories to reload their context
> ---------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 5h 40m
> Remaining Estimate: 0h
>
> {{AbstractSslContextFactory}} already loads keys and trust, applies TLS
> settings and caches the resulting context. It has no reload operation for
> subclasses that keeps the working context available during loading. Clearing
> the cache forces another load, but a load failure then leaves {{create()}}
> unable to return the previous context.
> Add an explicit reload operation for subclasses. This is the factory-level
> prerequisite for IGNITE-29256 and the running-node command in IGNITE-29210.
> h3. What to change
> # Add {{protected final void init()}} to rebuild the context from the
> factory's current settings, keys and trust. Replace the cache only after the
> new context is ready.
> # After success, the base {{create()}} returns the replacement. If loading
> fails, throw the error and keep the previous context. Do not change contexts
> already returned to callers.
> # Preserve the normal cache behavior of {{create()}}, the existing key and
> trust loading hooks and the protected cache field.
> h3. Compatibility
> Subclasses with their own no-argument {{init()}} must rename it and
> recompile: the new method is final.
> h3. Done when
> Tests show that a successful reload replaces an already cached context and a
> failed reload preserves it.
> Only the factory operation belongs here. Transport integration, the public
> command, certificate-date checks and scheduling follow in later tickets.
> [Implementation and checks in PR
> #13751|https://github.com/apache/ignite/pull/13751]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
