[
https://issues.apache.org/jira/browse/IGNITE-29211?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138506#comment-18138506
]
Anton Vinogradov commented on IGNITE-29211:
-------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13786] verdict for PR
13786 · RunAll build [9472125|https://ci2.ignite.apache.org/build/9472125] ·
tested
[a3a3d48|https://github.com/apache/ignite/pull/13786/commits/a3a3d48ecf9a08872ef34a02bd832d83100e1b9e]
· 149 suites ran, 0 reused
(!) *This run doesn't cover the PR fully:*
- 1 suite ran fewer tests than the same suite on master
Everything below is what it did manage to say.
(?) *1 suite ran fewer tests than on master* (tests that never ran can't fail):
- Cache 1: ran 530 of master's 605 tests (*-12%*)
(?) *No blockers found — but the run above can't prove the PR is clean.* 24
failing tests are not blamed on this PR. Re-run after you handle what is listed
above.
_What each label means and what to do: [verdict
glossary|https://github.com/anton-vinogradov/ignite-pr-checker/blob/main/docs/features.md#verdict-glossary]._
♻️ Settled after 1 auto re-run wave: #1 — 2 suites that failed mid-run.
> Renew TLS certificates automatically before expiry
> --------------------------------------------------
>
> Key: IGNITE-29211
> URL: https://issues.apache.org/jira/browse/IGNITE-29211
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h
> Remaining Estimate: 0h
>
> A node can load replacement certificates delivered to its configured source
> before its earliest chain expires. Enable {{renewalEnabled}} before startup.
> Use manual reload for trust-store changes or immediate rotation.
> h3. Result
> * Schedule renewal from the earliest expiry across all reported X.509 chains,
> including CA certificates. The first attempt falls in the last
> {{renewBeforeFraction}} of the chain lifetime, 15% by default. If several
> chains expire at the same time, renewal starts when the first of their
> windows opens. The node reads renewal settings at startup. With renewal
> enabled, it fails to start if the factory reports no X.509 chain or cannot
> report its chains.
> * Install a fresh context only when all replacement chains are valid and
> their earliest expiry advances. Otherwise keep the current material and retry
> with bounded backoff, including after expiry. Only retries are randomized.
> * Manual and scheduled loads run one at a time. A successful manual reload
> replans renewal. An attempt for the old context does nothing. Stopping the
> node while a renewal attempt reads its source keeps the previous material and
> counters. With renewal enabled, manual reload also requires the factory to
> report its chains.
> * {{--ssl status}} shows the next attempt. The node metric
> {{ssl.ConsecutiveRenewalFailures}} sums consecutive unsuccessful attempts
> across its factories, including attempts with unchanged expiry. Advancing the
> earliest expiry clears that factory's count. On a node without TLS the metric
> is zero.
> Use a separate renewal-enabled factory per running node: a node with renewal
> enabled fails to start if another running node already uses the same
> instance. Remote sources need a timeout and must respond to interruption.
> [Renewal and recovery
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29211/docs/_docs/security/ssl-tls.adoc#renewing-certificates-automatically].
> Builds on IGNITE-29210. Code and validation are in [PR
> #13786|https://github.com/apache/ignite/pull/13786]. Once both this task and
> IGNITE-29212 are present, include the [joint HTTPS renewal test and
> documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
> once in the PR merged second.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
