[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Allow administrators to replace node certificates and trust stores without
restarting nodes. Add {{control.sh --ssl reload}} and {{--ssl status}} for
server and client nodes in the current topology.
h3. Required behavior
* Keep one managed context per factory instance. Discovery, communication, the
client connector and binary REST must use it. Transports sharing the same
factory reload together. Distinct instances remain independent even if they
compare equal.
* New connections use the replacement context. Existing connections stay open.
Build and validate the replacement before installing it, and retain the
previous context on failure.
* Reject unsupported TLS settings, known invalid certificate dates, explicitly
missing private keys and a factory that returns the context already in use.
Unknown certificate metadata alone must not prevent manual reload. Do not probe
TLS connections or claim to verify peer trust.
* Report one result per factory on each node, listing its transports. Return an
error if any selected node fails, including a node that leaves before its job
is assigned. Continue processing the other nodes.
* Status reports loaded certificate metadata and reload results, including
unavailable metadata and invalid loaded certificates.
* Require ADMIN_OPS for both commands. Log each factory reload attempt with its
initiator.
h3. Tests and documentation
Cover all four transports, mutual TLS, trust-store changes, new and existing
connections, shared and separate factories, custom factories, partial failures,
nodes leaving the topology, permissions, audit output and command parsing.
Include the shared test certificate generator and Bouncy Castle as a test
dependency.
Explain certificate replacement, verification and recovery in the administrator
guide. Document fresh context creation, optional metadata and serialized
factory calls in the custom-factory reference.
h3. Dependencies and remaining work
The branch {{ignite-29210}} is prepared. Open its PR after IGNITE-29209 is
merged, then run CI on the updated branch.
This task delivers manual reload and status. Automatic renewal is tracked in
IGNITE-29211 and HTTP REST integration in IGNITE-29212.
was:
Allow administrators to replace node certificates and trust stores without
restarting nodes. Add control.sh --ssl reload and --ssl status for server and
client nodes currently in the topology. Report each factory separately on each
node, listing the transports that use it. Return an error if any target fails.
Introduce a node registry keyed by factory object identity. Discovery,
communication, the client connector, and binary REST must use its current
context. Transports sharing a factory reload together; distinct factory
instances remain independent even if they compare equal. New connections use
the replacement context and existing connections stay open.
Build and validate a candidate before installing it. Reject a replacement when
its metadata explicitly reports missing private keys, its known certificate
dates are invalid, its TLS settings are unsupported, or the factory returns the
context already in use. Unknown metadata alone must not prevent manual reload.
Failures retain the previous context. Validation must not perform TLS
connection probes or claim to verify peer trust. Status reports loaded metadata
and reload outcomes, including unavailable metadata and invalid loaded
certificates.
Require ADMIN_OPS for both commands and audit reload results with the
initiator. Document the custom-factory contract, including fresh creation,
optional metadata, and serialized calls for each factory.
Include operator instructions for replacement, verification, and recovery.
Tests must cover every core transport, mutual TLS and trust-store changes, new
and existing connections, shared and separate factories, custom factories,
partial failures, authorization, audit output, and command parsing.
Include the shared test certificate generator and Bouncy Castle with test scope
in the first PR that needs them.
Depends on IGNITE-29209. This task delivers complete manual reload and status;
scheduling and HTTP REST follow separately.
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
>
> Allow administrators to replace node certificates and trust stores without
> restarting nodes. Add {{control.sh --ssl reload}} and {{--ssl status}} for
> server and client nodes in the current topology.
> h3. Required behavior
> * Keep one managed context per factory instance. Discovery, communication,
> the client connector and binary REST must use it. Transports sharing the same
> factory reload together. Distinct instances remain independent even if they
> compare equal.
> * New connections use the replacement context. Existing connections stay
> open. Build and validate the replacement before installing it, and retain the
> previous context on failure.
> * Reject unsupported TLS settings, known invalid certificate dates,
> explicitly missing private keys and a factory that returns the context
> already in use. Unknown certificate metadata alone must not prevent manual
> reload. Do not probe TLS connections or claim to verify peer trust.
> * Report one result per factory on each node, listing its transports. Return
> an error if any selected node fails, including a node that leaves before its
> job is assigned. Continue processing the other nodes.
> * Status reports loaded certificate metadata and reload results, including
> unavailable metadata and invalid loaded certificates.
> * Require ADMIN_OPS for both commands. Log each factory reload attempt with
> its initiator.
> h3. Tests and documentation
> Cover all four transports, mutual TLS, trust-store changes, new and existing
> connections, shared and separate factories, custom factories, partial
> failures, nodes leaving the topology, permissions, audit output and command
> parsing. Include the shared test certificate generator and Bouncy Castle as a
> test dependency.
> Explain certificate replacement, verification and recovery in the
> administrator guide. Document fresh context creation, optional metadata and
> serialized factory calls in the custom-factory reference.
> h3. Dependencies and remaining work
> The branch {{ignite-29210}} is prepared. Open its PR after IGNITE-29209 is
> merged, then run CI on the updated branch.
> This task delivers manual reload and status. Automatic renewal is tracked in
> IGNITE-29211 and HTTP REST integration in IGNITE-29212.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
