Anton Vinogradov created IGNITE-29211:
-----------------------------------------
Summary: Renew TLS certificates automatically before expiry
Key: IGNITE-29211
URL: https://issues.apache.org/jira/browse/IGNITE-29211
Project: Ignite
Issue Type: Sub-task
Reporter: Anton Vinogradov
Assignee: Anton Vinogradov
Allow a node to pick up certificates delivered by an external system before the
loaded chain expires. Add opt-in renewal settings to AbstractSslContextFactory,
disabled by default, and schedule attempts from the certificate lifetime and
earliest expiry in its chain. Enabling renewal without chain metadata must fail
at startup.
Use the existing reload validation and install only a valid replacement whose
chain expires later. An unchanged chain, a loading error, or a rejected
replacement leaves the current context in use and triggers retries with bounded
backoff and jitter. Continue retrying after expiry, with useful logs and the
next attempt time in --ssl status.
Publish ssl.ConsecutiveRenewalFailures as the sum of consecutive unsuccessful
automatic attempts across distinct factory instances. Count a shared factory
once, including unchanged-certificate attempts. Reset only the affected
factory's count when automatic renewal or manual reload installs a chain with a
later expiry. Failed manual reloads must not increment this metric.
Serialize manual and automatic work for each factory, replan after successful
reload, and prevent a superseded renewal attempt from installing a stale
context. Interrupt and finish renewal work during shutdown without recording
cancellation as a renewal failure. Automatic work must use the node's operation
context.
Include renewal and metric documentation. Tests should cover timing, chain
expiry, retries after expiry, unchanged certificates, counter aggregation and
reset, manual reload races, shutdown, and default-off behavior.
Depends on IGNITE-29210; it can proceed independently of HTTP REST integration.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
