Skip to content

HDDS-8593. Add RootCARotationPoller to CertClient #5030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ChenSammi merged 5 commits into from
Jul 9, 2023
Merged

HDDS-8593. Add RootCARotationPoller to CertClient #5030

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
df0fa2b
HDDS-8593 start root ca rotation poller in DefaultCertificateClient a…
Galsza Jul 6, 2023
182278e
HDDS-8593 Combine logic for not starting scm certificate monitor with…
Galsza Jul 7, 2023
a5c5b99
HDDS-8593 Test Root Ca appears on datanode side as well
Galsza Jul 7, 2023
50ae3dc
HDDS-8593 Make CertificateRenewerService consistent accross logs
Galsza Jul 7, 2023
38df3bd
HDDS-8593 Make CertificateRenewerService consistent accross logs
Galsza Jul 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions ...ava/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@
import java.util.Objects;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.CompletableFuture;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
Expand Down Expand Up @@ -127,6 +128,7 @@ public abstract class DefaultCertificateClient implements CertificateClient {
private Runnable shutdownCallback;
private SCMSecurityProtocolClientSideTranslatorPB scmSecurityClient;
private final Set<CertificateNotification> notificationReceivers;
private RootCaRotationPoller rootCaRotationPoller;

protected DefaultCertificateClient(
SecurityConfig securityConfig,
Expand Down Expand Up @@ -183,6 +185,17 @@ private synchronized void loadAllCertificates() {
getLogger().info("CertificateLifetimeMonitor is disabled for {}",
component);
}
startRootCaRotationPoller();

@ChenSammi ChenSammi Jul 7, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SCMCertificateClient doesn't need this poller. You can move this under line 174 if statement. shouldStartCertificateMonitor can be changed to shouldStartCertificateMonitorService to cover both the service's lifetime monitor, rotation and root ca certificates monitor and fetch.

}

protected void startRootCaRotationPoller() {
if (rootCaRotationPoller == null) {
rootCaRotationPoller = new RootCaRotationPoller(securityConfig,
rootCaCertificates, scmSecurityClient);
rootCaRotationPoller.addRootCARotationProcessor(
this::getRootCaRotationListener);
rootCaRotationPoller.run();
}
}

private synchronized void readCertificateFile(Path filePath) {
Expand Down Expand Up @@ -985,6 +998,10 @@ public synchronized void close() throws IOException {
executorService = null;
}

if (rootCaRotationPoller != null) {
rootCaRotationPoller.close();
}

if (serverKeyStoresFactory != null) {
serverKeyStoresFactory.destroy();
}
Expand Down Expand Up @@ -1296,6 +1313,16 @@ protected boolean shouldStartCertificateMonitor() {
return true;
}

public synchronized CompletableFuture<Void> getRootCaRotationListener(
List<X509Certificate> rootCAs) {
if (rootCaCertificates.containsAll(rootCAs)) {
return CompletableFuture.completedFuture(null);
}
CertificateRenewerService renewerService =
new CertificateRenewerService(true);
return CompletableFuture.runAsync(renewerService, executorService);
}

public synchronized void startCertificateMonitor() {
Preconditions.checkNotNull(getCertificate(),
"Component certificate should not be empty");
Expand Down
5 changes: 5 additions & 0 deletions ...in/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,4 +231,9 @@ public String signAndStoreCertificate(PKCS10CertificationRequest request,
throw new RuntimeException(e);
}
}

@Override
protected void startRootCaRotationPoller() {
//SCM root CA rotation is handled separately from polling
}
}