[
https://issues.apache.org/jira/browse/NIFI-12125?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emilio Setiadarma reassigned NIFI-12125:
----------------------------------------
Assignee: Emilio Setiadarma
> nifi.security.autoreload.enabled does not trigger reload of SSLContext for
> cluster ServerSocket
> -----------------------------------------------------------------------------------------------
>
> Key: NIFI-12125
> URL: https://issues.apache.org/jira/browse/NIFI-12125
> Project: Apache NiFi
> Issue Type: Bug
> Components: Security
> Affects Versions: 1.23.2
> Environment: EKS Kube 1.27
> Reporter: Andrew Price
> Assignee: Emilio Setiadarma
> Priority: Major
>
> Running Nifi 1.23 as a containerized cluster on EKS with
> 'nifi.cluster.protocol.is.secure' set to true. Certificates are provisioned
> to Nifi keystores using mounted Kube Secrets, periodically copied from secret
> mount to keystore paths using sidecar container (avoiding NIFI-10425).
> Upon certificate expiration and renewal (with
> nifi.security.autoreload.enabled 'true'), Jetty server detects new
> certificates and refreshes its SSLContext as expected.
> However, cluster heartbeats (and potentially other cluster protocol messages)
> begin to fail upon certificate expiration due to SSL validation failures.
> Debugging of heartbeat events shows that nodes are sending heartbeats using
> an updated SSL context, but cluster SocketProtocolListener and underlying
> SocketListener continues to use stale SSLContext on an existing ServerSocket.
> It may be required for the ServerSocket used by SocketProtocolListener to be
> closed/recreated in order to refresh the underlying SSLContext, in order to
> provide the same behaviour nifi.security.autoreload.enabled provides for the
> HTTPS interface.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
