[TINKERPOP-3146] Support hot reloading of SSL certificates#3078
Conversation
cdegroc
force-pushed
the
reload-certificates-with-sslcontext-kickstart
branch
from
4b5be2d to
87c578c
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## 3.7-dev #3078 +/- ##
=============================================
+ Coverage 76.14% 76.18% +0.04%
- Complexity 13152 13257 +105
=============================================
Files 1084 1090 +6
Lines 65160 67536 +2376
Branches 7285 7360 +75
=============================================
+ Hits 49616 51455 +1839
- Misses 12839 13360 +521
- Partials 2705 2721 +16 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
cdegroc
force-pushed
the
reload-certificates-with-sslcontext-kickstart
branch
4 times, most recently
from
a8f30ff to
054f60f
Compare
| sslSettings.needClientAuth = ClientAuth.REQUIRE; | ||
| } | ||
|
|
||
| builder.clientAuth(sslSettings.needClientAuth).sslProvider(provider); |
There was a problem hiding this comment.
📝 SSLFactory does not expose an option to configure the SSL Provider. Instead, we configure it below (L. 381) on the Netty SslContextBuilder built from the SSLFactory.
cdegroc
force-pushed
the
reload-certificates-with-sslcontext-kickstart
branch
4 times, most recently
from
50b6c91 to
bd05ee0
Compare
cdegroc
changed the title
cdegroc
force-pushed
the
reload-certificates-with-sslcontext-kickstart
branch
from
9405e8a to
3c3cc63
Compare
|
It seems like this is the case, but I just wanted to confirm, the swapping is instant/atomic right? As in, theres no way for the SSL context to change during a handshake? |
That's my understanding, yes. This section in the library's documentation describes how the |
cdegroc
force-pushed
the
reload-certificates-with-sslcontext-kickstart
branch
from
3c3cc63 to
ca0ec97
Compare
cdegroc
force-pushed
the
reload-certificates-with-sslcontext-kickstart
branch
from
ca0ec97 to
d144f57
Compare
|
VOTE +1 |
| <artifactId>logback-classic</artifactId> | ||
| <optional>true</optional> | ||
| </dependency> | ||
| <dependency> |
There was a problem hiding this comment.
Note: This package is Apache 2 licensed with no provided NOTICE file. I see no concerns from a licensing standpoint.
|
VOTE +1 |
|
👋 Hey @andreachild, I've addressed your comment. Would you mind taking another look at the updated version when you have a chance? Thanks a lot! |
Set refreshInterval to <= 0 to disable hot reloading (previous behavior)
|
VOTE +1 |
Adds a file watcher that monitors certificate files for changes every minute. When changes are detected, the certificates are reloaded. Integrates the (Apache License) Hakky54/sslcontext-kickstart library (as suggested by the TinkerPop community) to enable hot-reloading of SSL certificates.
5 participants
This PR introduces support for dynamic reloading of SSL certificates:
Addresses https://issues.apache.org/jira/browse/TINKERPOP-3146