[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Allow administrators to replace TLS certificates and trust stores without
restarting nodes. Support automatic renewal when an external system supplies
new certificates.
h3. Review and merge plan
All five subtasks are created. The implementation is split into separate
branches.
# IGNITE-29208 — Preserve the peer address in SSLContextWrapper. [PR
#13750|https://github.com/apache/ignite/pull/13750] is open. This is an
independent bug fix.
# IGNITE-29209 — Add fresh SSL context creation and certificate metadata while
preserving existing factory hooks. [PR
#13751|https://github.com/apache/ignite/pull/13751] is open.
# IGNITE-29210 — Add manual reload and status for discovery, communication, the
client connector and binary REST, with authorization and audit. The branch is
prepared. Open its PR after IGNITE-29209 is merged.
# IGNITE-29211 — Add automatic renewal, retries and
ssl.ConsecutiveRenewalFailures. The branch is prepared. Open its PR after
IGNITE-29210 is merged.
# IGNITE-29212 — Add HTTP REST reload and instructions for migrating TLS from
Jetty XML. The branch is prepared. Open its PR after IGNITE-29210 is merged.
Review and merge the peer-address fix first because it touches the same wrapper
as the API change. The API branch also preserves peer addresses, so it works on
its own. Automatic renewal and HTTP REST are independent and may merge in
either order.
After both follow-ups are present, cherry-pick the [prepared integration
commit|https://github.com/anton-vinogradov/ignite/commit/b7c500ae589ca52f80ffdf3c3862d17f1a5ec67f]
into whichever change merges second. It contains the HTTP REST
automatic-renewal documentation, Javadoc and HTTPS renewal test. Re-run the
test after applying it to master.
h3. Updating branches after a squash merge
Before opening a dependent PR, create a new review branch from the current
master. Keep the prepared branch and record the exact head of its prerequisite
that was squash-merged. For example, prepare IGNITE-29210 after IGNITE-29209
has been squash-merged. Here upstream is apache/ignite and origin is the
contributor fork:
{code:bash}
git fetch upstream master
git fetch origin ignite-29210
git switch -c ignite-29210-review upstream/master
git diff <recorded-ignite-29209-head> origin/ignite-29210 | git apply --index
git diff --cached --check
git diff --cached
{code}
Resolve any rejected hunks, run the relevant tests, then commit and push the
new review branch. This preserves the prepared branches and requires no
force-push. If a PR is already open, merge master into its branch normally
instead.
When combining automatic renewal and HTTP REST, retain
CurrentSslContext.engineGetDefaultSSLParameters(). It must forward to the
active context so Jetty retains the configured protocols and cipher suites.
Check both TLS settings and HTTPS renewal after resolving conflicts.
h3. Completion criteria
Each PR must include its tests and documentation and pass CI on its current
head. After the prerequisites merge, update dependent branches so their PRs
show only their own changes.
Keep one context per factory instance. Transports sharing a factory reload
together. Reload checks available certificate metadata and supported TLS
settings. Administrators remain responsible for peer trust and testing new
connections.
Close this umbrella after all five parts are merged and the combined solution
passes the SSL tests, including mutual TLS and compatibility with existing
configurations.
The original [PR #13335|https://github.com/apache/ignite/pull/13335] remains
the reference implementation until the split is merged.
was:
Allow administrators to replace TLS certificates and trust stores without
restarting nodes. Support automatic renewal when an external system supplies
new certificates.
h3. Review and merge plan
All five subtasks are created. The implementation is split into separate
branches.
# IGNITE-29208 — Preserve the peer address in SSLContextWrapper. [PR
#13750|https://github.com/apache/ignite/pull/13750] is open. This is an
independent bug fix.
# IGNITE-29209 — Add fresh SSL context creation and certificate metadata while
preserving existing factory hooks. [PR
#13751|https://github.com/apache/ignite/pull/13751] is open.
# IGNITE-29210 — Add manual reload and status for discovery, communication, the
client connector and binary REST, with authorization and audit. The branch is
prepared. Open its PR after IGNITE-29209 is merged.
# IGNITE-29211 — Add automatic renewal, retries and
ssl.ConsecutiveRenewalFailures. The branch is prepared. Open its PR after
IGNITE-29210 is merged.
# IGNITE-29212 — Add HTTP REST reload and instructions for migrating TLS from
Jetty XML. The branch is prepared. Open its PR after IGNITE-29210 is merged.
Review and merge the peer-address fix first because it touches the same wrapper
as the API change. The API branch also preserves peer addresses, so it works on
its own. Automatic renewal and HTTP REST are independent and may merge in
either order.
When both follow-ups are present, include the HTTP REST automatic-renewal
documentation and Javadoc with whichever change merges second.
h3. Completion criteria
Each PR must include its tests and documentation and pass CI on its current
head. After the prerequisites merge, update dependent branches so their PRs
show only their own changes.
Keep one context per factory instance. Transports sharing a factory reload
together. Reload checks available certificate metadata and supported TLS
settings. Administrators remain responsible for peer trust and testing new
connections.
Close this umbrella after all five parts are merged and the combined solution
passes the SSL tests, including mutual TLS and compatibility with existing
configurations.
The original [PR #13335|https://github.com/apache/ignite/pull/13335] remains
the reference implementation until the split is merged.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 6h 50m
> Remaining Estimate: 0h
>
> Allow administrators to replace TLS certificates and trust stores without
> restarting nodes. Support automatic renewal when an external system supplies
> new certificates.
> h3. Review and merge plan
> All five subtasks are created. The implementation is split into separate
> branches.
> # IGNITE-29208 — Preserve the peer address in SSLContextWrapper. [PR
> #13750|https://github.com/apache/ignite/pull/13750] is open. This is an
> independent bug fix.
> # IGNITE-29209 — Add fresh SSL context creation and certificate metadata
> while preserving existing factory hooks. [PR
> #13751|https://github.com/apache/ignite/pull/13751] is open.
> # IGNITE-29210 — Add manual reload and status for discovery, communication,
> the client connector and binary REST, with authorization and audit. The
> branch is prepared. Open its PR after IGNITE-29209 is merged.
> # IGNITE-29211 — Add automatic renewal, retries and
> ssl.ConsecutiveRenewalFailures. The branch is prepared. Open its PR after
> IGNITE-29210 is merged.
> # IGNITE-29212 — Add HTTP REST reload and instructions for migrating TLS from
> Jetty XML. The branch is prepared. Open its PR after IGNITE-29210 is merged.
> Review and merge the peer-address fix first because it touches the same
> wrapper as the API change. The API branch also preserves peer addresses, so
> it works on its own. Automatic renewal and HTTP REST are independent and may
> merge in either order.
> After both follow-ups are present, cherry-pick the [prepared integration
> commit|https://github.com/anton-vinogradov/ignite/commit/b7c500ae589ca52f80ffdf3c3862d17f1a5ec67f]
> into whichever change merges second. It contains the HTTP REST
> automatic-renewal documentation, Javadoc and HTTPS renewal test. Re-run the
> test after applying it to master.
> h3. Updating branches after a squash merge
> Before opening a dependent PR, create a new review branch from the current
> master. Keep the prepared branch and record the exact head of its
> prerequisite that was squash-merged. For example, prepare IGNITE-29210 after
> IGNITE-29209 has been squash-merged. Here upstream is apache/ignite and
> origin is the contributor fork:
> {code:bash}
> git fetch upstream master
> git fetch origin ignite-29210
> git switch -c ignite-29210-review upstream/master
> git diff <recorded-ignite-29209-head> origin/ignite-29210 | git apply --index
> git diff --cached --check
> git diff --cached
> {code}
> Resolve any rejected hunks, run the relevant tests, then commit and push the
> new review branch. This preserves the prepared branches and requires no
> force-push. If a PR is already open, merge master into its branch normally
> instead.
> When combining automatic renewal and HTTP REST, retain
> CurrentSslContext.engineGetDefaultSSLParameters(). It must forward to the
> active context so Jetty retains the configured protocols and cipher suites.
> Check both TLS settings and HTTPS renewal after resolving conflicts.
> h3. Completion criteria
> Each PR must include its tests and documentation and pass CI on its current
> head. After the prerequisites merge, update dependent branches so their PRs
> show only their own changes.
> Keep one context per factory instance. Transports sharing a factory reload
> together. Reload checks available certificate metadata and supported TLS
> settings. Administrators remain responsible for peer trust and testing new
> connections.
> Close this umbrella after all five parts are merged and the combined solution
> passes the SSL tests, including mutual TLS and compatibility with existing
> configurations.
> The original [PR #13335|https://github.com/apache/ignite/pull/13335] remains
> the reference implementation until the split is merged.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
