[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Allow administrators to replace node TLS certificates and trust stores without
restarting nodes. When an external system delivers certificates, let Ignite
load valid replacements automatically before the current chains expire.
Existing connections remain usable; administrators prepare peer trust and
verify new connections.
h3. Parts and consumers
# IGNITE-29208 preserves the peer address of wrapped SSL engines. This
independently fixes existing addressed clients; [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 provides a factory-owned context and certificate snapshot from
one store read. Explicit {{init()}} publishes replacements; repeated
{{create()}}/{{sslBundle()}} calls reuse accepted material. Previously obtained
contexts remain snapshots; callers obtain the replacement from the factory.
Reload/status and renewal consume this API. [PR
#13751|https://github.com/apache/ignite/pull/13751] covers this part.
# IGNITE-29210 adds operator reload/status for discovery, communication, the
client connector and binary REST, with replacement checks, per-node results,
permissions and audit. Its node-owned forwarding context supplies the shared
mechanism used by the remaining tasks.
# IGNITE-29211 schedules opt-in certificate renewal, retries and monitoring.
The external delivery system remains responsible for issuing and supplying
replacements.
# IGNITE-29212 connects HTTP REST to reload/status. Together with IGNITE-29211,
it also supports automatic HTTPS certificate renewal.
h3. Merge and integration order
Merge IGNITE-29209, then open and merge IGNITE-29210. Open IGNITE-29211 and
IGNITE-29212 after that; they may merge in either order.
After IGNITE-29211 and IGNITE-29212 are both present, include the single [joint
integration
commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
in the PR that merges second. Apply it once, without replaying older
integration patches. It adds HTTPS automatic-renewal coverage and the
corresponding documentation/Javadoc. Run {{JettySslContextReloadTest}} and
{{SslRenewalNodeTest}} on that combined branch.
After a prerequisite is squash-merged, preserve the prepared branch and record
its exact prerequisite head. Create the dependent review branch from current
master and apply only its diff against that recorded head. If a PR is already
open, merge master normally. This keeps each review limited to its task without
force-pushing prepared branches.
h3. Completion
Each part must include its tests and user/developer documentation. Run targeted
checks on refreshed heads and verify the combined solution with mutual TLS,
trust changes, existing configurations and real automatic HTTPS renewal.
Preserve HTTP's configured TLS parameters when combining the branches.
The API passed 18 selected cases, Checkstyle and Javadoc/doclint at
{{06489a85}}. Manual checks passed 24 cases with one existing JMX skip: 23
provider/reload/reconnect cases at {{4a7ce7c9}}, then the CLI case and
Checkstyle at {{756e613f}}; the commons and core source trees are identical
between those heads. These are targeted local checks, not full CI.
Standalone renewal passed all 35 cases at {{a4bd1b1c}}; HTTP passed all 9 at
{{271ff0ed}}. Combined validation at {{fe6d4afd}} passed 109 cases with two
existing JMX skips, including automatic HTTPS renewal, permissions and audit.
Checkstyle passed for each run. The single joint commit {{889a3fde}} produces
the exact tested integration tree after merging the renewal and HTTP
foundations.
The private DataGrid/SecMan port and its final validation are still pending.
Follow [certificate rollout and
recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
and [factory
migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
Factory subclass compatibility changes belong to IGNITE-29209; transport and
Jetty migration limits are documented in their owning tasks. Close the umbrella
after all parts merge and combined validation passes.
The separate {{KillCommandsControlShTest}} stability fix is prepared on
{{ignite-consistency-cancellation-status}} for independent review. At
{{54b82830}}, both requested CLI tests passed; the two existing JMX variants
were skipped, and Checkstyle passed. It is not part of the TLS changes or a
dependency of this umbrella.
was:
Allow administrators to replace node TLS certificates and trust stores without
restarting nodes. When an external system delivers certificates, let Ignite
load valid replacements automatically before the current chains expire.
Existing connections remain usable; administrators prepare peer trust and
verify new connections.
h3. Parts and consumers
# IGNITE-29208 preserves the peer address of wrapped SSL engines. This
independently fixes existing addressed clients; [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 provides a factory-owned context and certificate snapshot from
one store read. Explicit {{init()}} publishes replacements; repeated
{{create()}}/{{sslBundle()}} calls reuse accepted material. Previously obtained
contexts remain snapshots; callers obtain the replacement from the factory.
Reload/status and renewal consume this API. [PR
#13751|https://github.com/apache/ignite/pull/13751] covers this part.
# IGNITE-29210 adds operator reload/status for discovery, communication, the
client connector and binary REST, with replacement checks, per-node results,
permissions and audit. Its node-owned forwarding context supplies the shared
mechanism used by the remaining tasks.
# IGNITE-29211 schedules opt-in certificate renewal, retries and monitoring.
The external delivery system remains responsible for issuing and supplying
replacements.
# IGNITE-29212 connects HTTP REST to reload/status. Together with IGNITE-29211,
it also supports automatic HTTPS certificate renewal.
h3. Merge and integration order
Merge IGNITE-29209, then open and merge IGNITE-29210. Open IGNITE-29211 and
IGNITE-29212 after that; they may merge in either order.
After IGNITE-29211 and IGNITE-29212 are both present, include the single [joint
integration
commit|https://github.com/anton-vinogradov/ignite/commit/e1a7c86c428cf775ef86750bfdca746d1cdeb88c]
in the PR that merges second. Apply it once, without replaying older
integration patches. It adds HTTPS automatic-renewal coverage and the
corresponding documentation/Javadoc. Run {{JettySslContextReloadTest}} and
{{SslRenewalNodeTest}} on that combined branch.
After a prerequisite is squash-merged, preserve the prepared branch and record
its exact prerequisite head. Create the dependent review branch from current
master and apply only its diff against that recorded head. If a PR is already
open, merge master normally. This keeps each review limited to its task without
force-pushing prepared branches.
h3. Completion
Each part must include its tests and user/developer documentation. Run targeted
checks on refreshed heads and verify the combined solution with mutual TLS,
trust changes, existing configurations and real automatic HTTPS renewal.
Preserve HTTP's configured TLS parameters when combining the branches. All 16
API tests and both standalone startup-regression tests passed with Checkstyle.
The final loading-hook Javadoc correction passed doclint and did not change
Java code.
Final heads: API {{1b17a46f}}, manual {{16f815de}}, renewal {{5c5aebec}}, HTTP
{{90489d2a}}; combined integration {{aab6d7ce}}. The combined clean reactor
passed 109 tests, with two existing JMX skips, and Checkstyle. Standalone
manual passed 22 provider/reload tests, renewal passed 35 renewal/node tests,
and HTTP passed nine HTTPS tests, each with Checkstyle. The combined and HTTP
Java code is unchanged since those runs; the subsequent merge only corrects
Javadoc. These are local checks, not full CI. The public implementation and
targeted validation are ready; the private DataGrid/SecMan port and its final
validation are still pending.
Follow [certificate rollout and
recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
and [factory
migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
Factory subclass compatibility changes belong to IGNITE-29209; transport and
Jetty migration limits are documented in their owning tasks. Close the umbrella
after all parts merge and combined validation passes.
The separate {{KillCommandsControlShTest}} stability fix is prepared on
{{ignite-consistency-cancellation-status}} for independent review. At
{{54b82830}}, both requested CLI tests passed; the two existing JMX variants
were skipped, and Checkstyle passed. It is not part of the TLS changes or a
dependency of this umbrella.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 6h 50m
> Remaining Estimate: 0h
>
> Allow administrators to replace node TLS certificates and trust stores
> without restarting nodes. When an external system delivers certificates, let
> Ignite load valid replacements automatically before the current chains
> expire. Existing connections remain usable; administrators prepare peer trust
> and verify new connections.
> h3. Parts and consumers
> # IGNITE-29208 preserves the peer address of wrapped SSL engines. This
> independently fixes existing addressed clients; [PR
> #13750|https://github.com/apache/ignite/pull/13750] is merged.
> # IGNITE-29209 provides a factory-owned context and certificate snapshot from
> one store read. Explicit {{init()}} publishes replacements; repeated
> {{create()}}/{{sslBundle()}} calls reuse accepted material. Previously
> obtained contexts remain snapshots; callers obtain the replacement from the
> factory. Reload/status and renewal consume this API. [PR
> #13751|https://github.com/apache/ignite/pull/13751] covers this part.
> # IGNITE-29210 adds operator reload/status for discovery, communication, the
> client connector and binary REST, with replacement checks, per-node results,
> permissions and audit. Its node-owned forwarding context supplies the shared
> mechanism used by the remaining tasks.
> # IGNITE-29211 schedules opt-in certificate renewal, retries and monitoring.
> The external delivery system remains responsible for issuing and supplying
> replacements.
> # IGNITE-29212 connects HTTP REST to reload/status. Together with
> IGNITE-29211, it also supports automatic HTTPS certificate renewal.
> h3. Merge and integration order
> Merge IGNITE-29209, then open and merge IGNITE-29210. Open IGNITE-29211 and
> IGNITE-29212 after that; they may merge in either order.
> After IGNITE-29211 and IGNITE-29212 are both present, include the single
> [joint integration
> commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
> in the PR that merges second. Apply it once, without replaying older
> integration patches. It adds HTTPS automatic-renewal coverage and the
> corresponding documentation/Javadoc. Run {{JettySslContextReloadTest}} and
> {{SslRenewalNodeTest}} on that combined branch.
> After a prerequisite is squash-merged, preserve the prepared branch and
> record its exact prerequisite head. Create the dependent review branch from
> current master and apply only its diff against that recorded head. If a PR is
> already open, merge master normally. This keeps each review limited to its
> task without force-pushing prepared branches.
> h3. Completion
> Each part must include its tests and user/developer documentation. Run
> targeted checks on refreshed heads and verify the combined solution with
> mutual TLS, trust changes, existing configurations and real automatic HTTPS
> renewal. Preserve HTTP's configured TLS parameters when combining the
> branches.
> The API passed 18 selected cases, Checkstyle and Javadoc/doclint at
> {{06489a85}}. Manual checks passed 24 cases with one existing JMX skip: 23
> provider/reload/reconnect cases at {{4a7ce7c9}}, then the CLI case and
> Checkstyle at {{756e613f}}; the commons and core source trees are identical
> between those heads. These are targeted local checks, not full CI.
> Standalone renewal passed all 35 cases at {{a4bd1b1c}}; HTTP passed all 9 at
> {{271ff0ed}}. Combined validation at {{fe6d4afd}} passed 109 cases with two
> existing JMX skips, including automatic HTTPS renewal, permissions and audit.
> Checkstyle passed for each run. The single joint commit {{889a3fde}} produces
> the exact tested integration tree after merging the renewal and HTTP
> foundations.
> The private DataGrid/SecMan port and its final validation are still pending.
> Follow [certificate rollout and
> recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
> and [factory
> migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> Factory subclass compatibility changes belong to IGNITE-29209; transport and
> Jetty migration limits are documented in their owning tasks. Close the
> umbrella after all parts merge and combined validation passes.
> The separate {{KillCommandsControlShTest}} stability fix is prepared on
> {{ignite-consistency-cancellation-status}} for independent review. At
> {{54b82830}}, both requested CLI tests passed; the two existing JMX variants
> were skipped, and Checkstyle passed. It is not part of the TLS changes or a
> dependency of this umbrella.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
