[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Allow administrators to replace node certificates and trust stores without
restarting nodes. Add {{control.sh --ssl reload}} and {{--ssl status}} for
server and client nodes in the current topology.
h3. Required behavior
* Keep one managed context per factory instance. Discovery, communication, the
client connector and binary REST must use it. Transports sharing the same
factory reload together. Distinct instances remain independent even if they
compare equal.
* New connections use the replacement context. Existing connections stay open.
Build and validate the replacement before installing it, and retain the
previous context on failure.
* Reject unsupported TLS settings, known invalid certificate dates, explicitly
missing private keys and a factory that returns the context already in use.
Unknown certificate metadata alone must not prevent manual reload. Do not probe
TLS connections or claim to verify peer trust.
* Report one result per factory on each node, listing its transports. Return an
error if any selected node fails, including a node that leaves before its job
is assigned. Continue processing the other nodes.
* Status reports loaded certificate metadata and reload results, including
unavailable metadata and invalid loaded certificates.
* Require ADMIN_OPS for both commands. Log each factory reload attempt with its
initiator.
h3. Tests and documentation
Cover all four transports, mutual TLS, trust-store changes, new and existing
connections, shared and separate factories, custom factories, partial failures,
nodes leaving the topology, permissions, audit output and command parsing.
Include the shared test certificate generator and Bouncy Castle as a test
dependency.
Explain certificate replacement, verification and recovery in the administrator
guide. Document fresh context creation, optional metadata and serialized
factory calls in the custom-factory reference.
h3. Dependencies and remaining work
The branch {{ignite-29210}} is prepared. Open its PR after IGNITE-29209 is
merged, then run CI on the updated branch.
This task delivers manual reload and status. Automatic renewal is tracked in
IGNITE-29211 and HTTP REST integration in IGNITE-29212.
h3. Compatibility
The protected TcpDiscoverySpi.sslSockFactory and
TcpDiscoverySpi.sslSrvSockFactory fields are removed. This is a source and
binary compatibility change for custom TcpDiscoverySpi subclasses that access
these fields; adapt those subclasses before upgrading.
Protocol and cipher-suite names configured through AbstractSslContextFactory
must be supported by the running JVM. Unsupported names now fail node startup
for every managed TCP transport: discovery, communication, the client connector
and binary REST. Some transports previously detected these errors only when
opening a connection.
For a plain Factory<SSLContext>, the node calls create() when registering the
factory at startup and once per requested reload. Transports configured with
the same factory object share its context. Communication no longer calls
create() for each outgoing connection, so custom factories must not rely on
those calls to refresh certificates. To support reload, each subsequent call
must return a fresh SSLContext.
was:
Allow administrators to replace node certificates and trust stores without
restarting nodes. Add {{control.sh --ssl reload}} and {{--ssl status}} for
server and client nodes in the current topology.
h3. Required behavior
* Keep one managed context per factory instance. Discovery, communication, the
client connector and binary REST must use it. Transports sharing the same
factory reload together. Distinct instances remain independent even if they
compare equal.
* New connections use the replacement context. Existing connections stay open.
Build and validate the replacement before installing it, and retain the
previous context on failure.
* Reject unsupported TLS settings, known invalid certificate dates, explicitly
missing private keys and a factory that returns the context already in use.
Unknown certificate metadata alone must not prevent manual reload. Do not probe
TLS connections or claim to verify peer trust.
* Report one result per factory on each node, listing its transports. Return an
error if any selected node fails, including a node that leaves before its job
is assigned. Continue processing the other nodes.
* Status reports loaded certificate metadata and reload results, including
unavailable metadata and invalid loaded certificates.
* Require ADMIN_OPS for both commands. Log each factory reload attempt with its
initiator.
h3. Tests and documentation
Cover all four transports, mutual TLS, trust-store changes, new and existing
connections, shared and separate factories, custom factories, partial failures,
nodes leaving the topology, permissions, audit output and command parsing.
Include the shared test certificate generator and Bouncy Castle as a test
dependency.
Explain certificate replacement, verification and recovery in the administrator
guide. Document fresh context creation, optional metadata and serialized
factory calls in the custom-factory reference.
h3. Dependencies and remaining work
The branch {{ignite-29210}} is prepared. Open its PR after IGNITE-29209 is
merged, then run CI on the updated branch.
This task delivers manual reload and status. Automatic renewal is tracked in
IGNITE-29211 and HTTP REST integration in IGNITE-29212.
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
>
> Allow administrators to replace node certificates and trust stores without
> restarting nodes. Add {{control.sh --ssl reload}} and {{--ssl status}} for
> server and client nodes in the current topology.
> h3. Required behavior
> * Keep one managed context per factory instance. Discovery, communication,
> the client connector and binary REST must use it. Transports sharing the same
> factory reload together. Distinct instances remain independent even if they
> compare equal.
> * New connections use the replacement context. Existing connections stay
> open. Build and validate the replacement before installing it, and retain the
> previous context on failure.
> * Reject unsupported TLS settings, known invalid certificate dates,
> explicitly missing private keys and a factory that returns the context
> already in use. Unknown certificate metadata alone must not prevent manual
> reload. Do not probe TLS connections or claim to verify peer trust.
> * Report one result per factory on each node, listing its transports. Return
> an error if any selected node fails, including a node that leaves before its
> job is assigned. Continue processing the other nodes.
> * Status reports loaded certificate metadata and reload results, including
> unavailable metadata and invalid loaded certificates.
> * Require ADMIN_OPS for both commands. Log each factory reload attempt with
> its initiator.
> h3. Tests and documentation
> Cover all four transports, mutual TLS, trust-store changes, new and existing
> connections, shared and separate factories, custom factories, partial
> failures, nodes leaving the topology, permissions, audit output and command
> parsing. Include the shared test certificate generator and Bouncy Castle as a
> test dependency.
> Explain certificate replacement, verification and recovery in the
> administrator guide. Document fresh context creation, optional metadata and
> serialized factory calls in the custom-factory reference.
> h3. Dependencies and remaining work
> The branch {{ignite-29210}} is prepared. Open its PR after IGNITE-29209 is
> merged, then run CI on the updated branch.
> This task delivers manual reload and status. Automatic renewal is tracked in
> IGNITE-29211 and HTTP REST integration in IGNITE-29212.
> h3. Compatibility
> The protected TcpDiscoverySpi.sslSockFactory and
> TcpDiscoverySpi.sslSrvSockFactory fields are removed. This is a source and
> binary compatibility change for custom TcpDiscoverySpi subclasses that access
> these fields; adapt those subclasses before upgrading.
> Protocol and cipher-suite names configured through AbstractSslContextFactory
> must be supported by the running JVM. Unsupported names now fail node startup
> for every managed TCP transport: discovery, communication, the client
> connector and binary REST. Some transports previously detected these errors
> only when opening a connection.
> For a plain Factory<SSLContext>, the node calls create() when registering the
> factory at startup and once per requested reload. Transports configured with
> the same factory object share its context. Communication no longer calls
> create() for each outgoing connection, so custom factories must not rely on
> those calls to refresh certificates. To support reload, each subsequent call
> must return a fresh SSLContext.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
