[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138481#comment-18138481
]
Anton Vinogradov commented on IGNITE-29209:
-------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13751] verdict for PR
13751 · RunAll build [9471825|https://ci2.ignite.apache.org/build/9471825] ·
tested
[e29bfc9|https://github.com/apache/ignite/pull/13751/commits/e29bfc913ae6959c93cfa74d8a88f142aa4d89c1]
· 149 suites ran, 0 reused
(/) *No blockers* — nothing in this run looks caused by this PR. 27 failing
tests are not blamed on this PR.
_What each label means and what to do: [verdict
glossary|https://github.com/anton-vinogradov/ignite-pr-checker/blob/main/docs/features.md#verdict-glossary]._
♻️ Settled after 1 auto re-run wave: #1 — 2 suites that failed mid-run.
> Add SSL bundle metadata and explicit factory initialization
> -----------------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 4.5h
> Remaining Estimate: 0h
>
> A custom SSL factory can load its TLS context and private-key certificate
> chains together. A subclass can use a certificate from this bundle to
> authenticate a restarted node. IGNITE-29210 and IGNITE-29211 use the same
> bundle for reload and renewal.
> h3. Result
> * The first {{create()}} loads the material. Once initialized, it returns the
> current context immediately, even while a replacement loads. A subclass can
> call protected {{init()}} at node startup to reread its source. If that load
> fails, existing contexts, engines and sockets remain usable.
> * Until IGNITE-29210, transports on a running node keep the contexts obtained
> at startup. Only new outgoing communication connections pick up a replacement.
> * The bundle contains immutable X.509 chains by private-key alias. An empty
> map means the source has no such chains. A source unable to report its chains
> supplies null metadata. Serialization preserves the factory configuration and
> first use after deserialization loads the material again.
> h3. Compatibility
> Update and recompile subclasses that override {{create()}}, declare their own
> no-argument {{init()}}, implement the former {{createKeyManagers()}} hook or
> use the former {{sslCtx}} field. Client factories may return a null key
> store. Unknown protocol or cipher names fail at first initialization,
> including node startup. [Subclass migration
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> Code and validation are in [PR
> #13751|https://github.com/apache/ignite/pull/13751].
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
