[HADOOP-16524] Automatic keystore reloading for HttpServer2

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.1, 3.4.0
• Fix Version/s: 3.3.1, 3.4.0
• Component/s: common
• Labels: pull-request-available
• Target Version/s: 3.4.0
• Hadoop Flags: Reviewed

Release Note

Adds auto-reload of keystore.

Adds below new config (default 10 seconds):

 ssl.{0}.stores.reload.interval

The refresh interval used to check if either of the truststore or keystore certificate file has changed.

• Assignee: Borislav Iordanov
• Reporter: Kihwal Lee
• Created: 21/Aug/19 18:23
• Updated: 27/Jan/24 06:33
• Resolved: 31/Mar/21 18:07

Description

Jetty 9 simplified reloading of keystore.   This allows hadoop daemon's SSL cert to be updated in place without having to restart the service.

Issue Links

• breaks: YARN-10568 TestTimelineClient#testTimelineClientCleanup fails on trunk
• is related to: HADOOP-17608 Fix TestKMS failure
• relates to: HDFS-16002 TestJournalNodeRespectsBindHostKeys#testHttpsBindHostKey very flaky
• links to: GitHub Pull Request #2470
• links to: GitHub Pull Request #2609
• links to: pr2693

Sub-Tasks

• Ignore missing keystore configuration in reloading mechanism: Resolved