influxdata / influxdata/influxdb

[2.x] Use SIGHUP to reload TLS certificates

Open
#24,873 0 comments 3 reactions 1 assignee Claimed by @gwossum View on GitHub
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

## Issue

Influxd OSS requires that paths to TLS keys and certs are passed in config files or command line. This means rotating a cert needs to restart influxd which can be undesirable.

See OSS documentation: https://docs.influxdata.com/influxdb/v2/admin/security/enable-tls/

## Ask

Implement a SIGHUP handler to reload certs and keys on demand. The db engine should stay online but all connections using TLS would need to restart. It would reload the paths from the config file (if a file was used) permitting using new paths or the same paths if from command line.

## Not-Ask

Do not reload the entire config file as this would require determining and testing which can be reloaded (possibly with new implementation to support other configs besides certs)

### references

* how vault does this: https://support.hashicorp.com/hc/en-us/articles/4417759906835-Replacing-the-TLS-certificate-and-key-on-a-running-Vault-cluster-without-requiring-a-restart-unseal
* how nginx uses this signal to reload the entire config file: https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/
* earlier ticket: https://github.com/influxdata/influxdb/issues/24652
* earlier ticket: https://github.com/influxdata/influxdb/issues/7037

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.