-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[feature] Reload TLSConfig.CAFile on SIGHUP #3746
Comments
Seems reasonable to me! Hopefully as easy as giving |
I think you will also want to refresh the Edit: It looks like the vault client is being reloaded, not sure about consul. |
It looks like #3492 would almost resolve this issue. The only problem is that this function would potentially prevent reloads when they might be desired. In my case, the TLSConfig itself does not change, but the contents of the files referenced in the TLSConfig do change when a new CA is issued. If this reload would happen every time a |
Sounds great @schmichael! Thanks for keeping us updated. |
I think this might be the enhancement we're looking for? |
I believe that PR does fix this issue @SoMuchToGrok. Though the fix does not reload the CA or cert on Seems like we can close this @schmichael? |
Yes, thanks @Xopherus! Closing. |
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
A very much appreciated feature was recently delivered to support graceful reloads of the TLS configuration.
https://github.com/hashicorp/nomad/pull/3479/files
I think this needs to be extended to also refresh the CA file (if defined). I run very short TTLs on both server certificates and root CAs. As it's currently implemented, this is still a huge pain point for me.
I might be able to take a stab at this myself, but want to get a conversation going first. Thoughts or concerns?
Thanks!
The text was updated successfully, but these errors were encountered: