influxdata / influxdata/influxdb
[2.x] Use SIGHUP to reload TLS certificates
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
## Issue
Influxd OSS requires that paths to TLS keys and certs are passed in config files or command line. This means rotating a cert needs to restart influxd which can be undesirable.
See OSS documentation: https://docs.influxdata.com/influxdb/v2/admin/security/enable-tls/
## Ask
Implement a SIGHUP handler to reload certs and keys on demand. The db engine should stay online but all connections using TLS would need to restart. It would reload the paths from the config file (if a file was used) permitting using new paths or the same paths if from command line.
## Not-Ask
Do not reload the entire config file as this would require determining and testing which can be reloaded (possibly with new implementation to support other configs besides certs)
### references
* how vault does this: https://support.hashicorp.com/hc/en-us/articles/4417759906835-Replacing-the-TLS-certificate-and-key-on-a-running-Vault-cluster-without-requiring-a-restart-unseal
* how nginx uses this signal to reload the entire config file: https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/
* earlier ticket: https://github.com/influxdata/influxdb/issues/24652
* earlier ticket: https://github.com/influxdata/influxdb/issues/7037
Contributor guide
Assessment
This issue has not been assessed yet.