Tim-Brooks commented 5 years ago

Support rolling upgrades to enable security

Currently it is impossible to upgrade a non-secured cluster to a secured cluster due to the need to enable TLS. We would like to enable a way for cluster nodes to speak both TLS and plaintext during a rolling restart.

Requirements

[ ] Add dynamic xpack.security.transport.ssl.dual_stack.enabled setting to allow TLS nodes to open and accept plaintext connections (#39532)
[ ] Modify PKI Realm to handle scenario where connection does not have SSLEngine (#39532)
[ ] Netty transport support accepting plaintext connections when dual_stack enabled (#39532)
[ ] Nio transport support accepting plaintext connections when dual_stack enabled
[ ] Netty transport support opening plaintext connections when dual_stack enabled
[ ] Nio transport support opening plaintext connections when dual_stack enabled
[ ] Close plaintext connections when dual_stack setting is updated to disabled
- 39532 handles this for connections accepted by the netty transport.
[ ] Add rolling upgrade test for a cluster upgrading from no TLS to TLS enabled

Considerations

[ ] Should we accept http connections?
[ ] Some level of user feedback/warning if dual_stack is accidentally left enabled?
- We could consider some type of functionality where we stop allowing plaintext connections after some period of time.
[ ] Is there a potential race for disabling dual_stack (requires propagating settings through nodes) and plaintext connections being closed? This should not be a common scenario because you should normally only be disabling this setting once all nodes have security enabled.
- We should maybe consider adding a UI to support this.

elasticmachine commented 5 years ago

Pinging @elastic/es-security

howardhuanghua commented 5 years ago

Very useful enhancement. @tbrooks8 , so except SSL, update xpack.security.enabled config also needs full cluster restart? Do we have plan to enhance this part?

jgimenez commented 3 years ago

Seems like #39532 has been closed, I understand this will not be done. Has then this enhancement been discarded as well?

tvernum commented 3 years ago

It is very unlikely that we will continue with this approach, but we have not entirely abandoned the idea of rolling upgrades to security.

elasticsearchmachine commented 2 years ago

Pinging @elastic/es-security (Team:Security)

elastic / elasticsearch