[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Allow administrators to replace node TLS certificates and trust stores without
restarting nodes. When an external system delivers certificates, let Ignite
load valid replacements automatically before the current chains expire.
Existing connections remain usable; peer trust must be prepared separately.
h3. Parts and consumers
# IGNITE-29208 preserves the peer address of wrapped SSL engines; [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 keeps a factory-owned context and certificate snapshot from one
store read. {{init()}} publishes replacements atomically and retains working
material on failure; {{create()}}/{{sslBundle()}} reuse accepted material.
Previously obtained contexts remain snapshots. [PR
#13751|https://github.com/apache/ignite/pull/13751] covers this part.
# IGNITE-29210 adds reload/status for discovery, communication, the client
connector and binary REST, with validation, per-node results, permissions and
audit. Its forwarding context lets node transports follow replacements.
# IGNITE-29211 adds opt-in renewal, retries and monitoring; the external system
still issues and supplies certificates.
# IGNITE-29212 adds HTTP REST to reload/status and, together with IGNITE-29211,
automatic HTTPS renewal.
h3. Merge and integration order
Merge IGNITE-29209, then IGNITE-29210. Open IGNITE-29211 and IGNITE-29212 after
that; they may merge in either order. Include the [joint integration
commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
once in the PR that merges second, after both foundations are present.
h3. Completion
Each part includes tests and user/developer documentation. Verify the combined
solution with mutual TLS, trust changes, existing configurations and automatic
HTTPS renewal, preserving configured HTTP TLS parameters.
Factory subclasses require adaptation and recompilation under IGNITE-29209;
plain {{Factory<SSLContext>}} remains supported. Transport and Jetty migration
limits belong to their owning tasks. See [factory
migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory]
and [certificate
rollout/recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
Targeted local checks passed for all prepared parts. Combined validation at
{{fe6d4afd}} passed 109 cases with two existing JMX skips and Checkstyle. This
is not full CI. Close the umbrella after all parts merge and combined
validation passes.
was:
Allow administrators to replace node TLS certificates and trust stores without
restarting nodes. When an external system delivers certificates, let Ignite
load valid replacements automatically before the current chains expire.
Existing connections remain usable; administrators prepare peer trust and
verify new connections.
h3. Parts and consumers
# IGNITE-29208 preserves the peer address of wrapped SSL engines. This
independently fixes existing addressed clients; [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 provides a factory-owned context and certificate snapshot from
one store read. Explicit {{init()}} publishes replacements; repeated
{{create()}}/{{sslBundle()}} calls reuse accepted material. Previously obtained
contexts remain snapshots; callers obtain the replacement from the factory.
Reload/status and renewal consume this API. [PR
#13751|https://github.com/apache/ignite/pull/13751] covers this part.
# IGNITE-29210 adds operator reload/status for discovery, communication, the
client connector and binary REST, with replacement checks, per-node results,
permissions and audit. Its node-owned forwarding context supplies the shared
mechanism used by the remaining tasks.
# IGNITE-29211 schedules opt-in certificate renewal, retries and monitoring.
The external delivery system remains responsible for issuing and supplying
replacements.
# IGNITE-29212 connects HTTP REST to reload/status. Together with IGNITE-29211,
it also supports automatic HTTPS certificate renewal.
h3. Merge and integration order
Merge IGNITE-29209, then open and merge IGNITE-29210. Open IGNITE-29211 and
IGNITE-29212 after that; they may merge in either order.
After IGNITE-29211 and IGNITE-29212 are both present, include the single [joint
integration
commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
in the PR that merges second. Apply it once, without replaying older
integration patches. It adds HTTPS automatic-renewal coverage and the
corresponding documentation/Javadoc. Run {{JettySslContextReloadTest}} and
{{SslRenewalNodeTest}} on that combined branch.
After a prerequisite is squash-merged, preserve the prepared branch and record
its exact prerequisite head. Create the dependent review branch from current
master and apply only its diff against that recorded head. If a PR is already
open, merge master normally. This keeps each review limited to its task without
force-pushing prepared branches.
h3. Completion
Each part must include its tests and user/developer documentation. Run targeted
checks on refreshed heads and verify the combined solution with mutual TLS,
trust changes, existing configurations and real automatic HTTPS renewal.
Preserve HTTP's configured TLS parameters when combining the branches.
The API passed 18 selected cases, Checkstyle and Javadoc/doclint at
{{06489a85}}. Manual checks passed 24 cases with one existing JMX skip: 23
provider/reload/reconnect cases at {{4a7ce7c9}}, then the CLI case and
Checkstyle at {{756e613f}}; the commons and core source trees are identical
between those heads. These are targeted local checks, not full CI.
Standalone renewal passed all 35 cases at {{a4bd1b1c}}; HTTP passed all 9 at
{{271ff0ed}}. Combined validation at {{fe6d4afd}} passed 109 cases with two
existing JMX skips, including automatic HTTPS renewal, permissions and audit.
Checkstyle passed for each run. The single joint commit {{889a3fde}} produces
the exact tested integration tree after merging the renewal and HTTP
foundations.
The private DataGrid/SecMan port and its final validation are still pending.
Follow [certificate rollout and
recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
and [factory
migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
Factory subclass compatibility changes belong to IGNITE-29209; transport and
Jetty migration limits are documented in their owning tasks. Close the umbrella
after all parts merge and combined validation passes.
The separate {{KillCommandsControlShTest}} stability fix is prepared on
{{ignite-consistency-cancellation-status}} for independent review. At
{{54b82830}}, both requested CLI tests passed; the two existing JMX variants
were skipped, and Checkstyle passed. It is not part of the TLS changes or a
dependency of this umbrella.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 6h 50m
> Remaining Estimate: 0h
>
> Allow administrators to replace node TLS certificates and trust stores
> without restarting nodes. When an external system delivers certificates, let
> Ignite load valid replacements automatically before the current chains
> expire. Existing connections remain usable; peer trust must be prepared
> separately.
> h3. Parts and consumers
> # IGNITE-29208 preserves the peer address of wrapped SSL engines; [PR
> #13750|https://github.com/apache/ignite/pull/13750] is merged.
> # IGNITE-29209 keeps a factory-owned context and certificate snapshot from
> one store read. {{init()}} publishes replacements atomically and retains
> working material on failure; {{create()}}/{{sslBundle()}} reuse accepted
> material. Previously obtained contexts remain snapshots. [PR
> #13751|https://github.com/apache/ignite/pull/13751] covers this part.
> # IGNITE-29210 adds reload/status for discovery, communication, the client
> connector and binary REST, with validation, per-node results, permissions and
> audit. Its forwarding context lets node transports follow replacements.
> # IGNITE-29211 adds opt-in renewal, retries and monitoring; the external
> system still issues and supplies certificates.
> # IGNITE-29212 adds HTTP REST to reload/status and, together with
> IGNITE-29211, automatic HTTPS renewal.
> h3. Merge and integration order
> Merge IGNITE-29209, then IGNITE-29210. Open IGNITE-29211 and IGNITE-29212
> after that; they may merge in either order. Include the [joint integration
> commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
> once in the PR that merges second, after both foundations are present.
> h3. Completion
> Each part includes tests and user/developer documentation. Verify the
> combined solution with mutual TLS, trust changes, existing configurations and
> automatic HTTPS renewal, preserving configured HTTP TLS parameters.
> Factory subclasses require adaptation and recompilation under IGNITE-29209;
> plain {{Factory<SSLContext>}} remains supported. Transport and Jetty
> migration limits belong to their owning tasks. See [factory
> migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory]
> and [certificate
> rollout/recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
> Targeted local checks passed for all prepared parts. Combined validation at
> {{fe6d4afd}} passed 109 cases with two existing JMX skips and Checkstyle.
> This is not full CI. Close the umbrella after all parts merge and combined
> validation passes.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
