feat: add TLS certificate reloading on SIGHUP #26994

gwossum · 2025-11-24T23:50:55Z

Add TLS certificate reloading on SIGHUP. For httpd service certificates, the configuration is reloaded and certificate and key file locations are updated accordingly. For opentsdb service certificates, certificates and keys at the existing locations are reloaded. If reloading a certificate fails, the currently loaded certificate continues to be used.

Also adds file permission checking for TLS certificates and private keys.

Add TLS certificate reloading on SIGHUP. For httpd service certificates, the configuration is reloaded and certificate and key file locations are updated accordingly. For opentsdb service certificates, certificates and keys at the existing locations are reloaded. If reloading a certificate fails, the currently loaded certificate continues to be used. Also adds file permission checking for TLS certificates and private keys.

Rewrite some tests so that tricks are not used to get a hold of the TLS certificate in-use. Instead, an HTTP client is used to get the certificate presented by the http service.

gwossum · 2025-11-24T23:53:53Z

pkg/tlsconfig/certconfig.go

+// VerifyLoad verifies that the certificate at certPath and keyPath will load without error.
+// If the certificate can be loaded, a function that will apply the certificate reload is
+// returned. Otherwise, an error is returned.
+func (cl *TLSCertLoader) VerifyLoad(certPath, keyPath string) (func() error, error) {


I'm not convinced VerifyLoad is the best name for this method. The name does make sense, because it is used on config reload to verify that that the new configuration and/or certificate will load properly before it is applied. The name is seems off, though, when you consider that it also returns a closure that will apply the change. Maybe something like PrepareReload would be a better name?

MakeReloadFunc ??

pkg/tlsconfig/tls_config.go

gwossum · 2025-11-24T23:55:47Z

services/opentsdb/service.go

+// VerifyReloadTLSCertificate verifies that the configured TLS certificate can be reloaded.
+// If so, then a function that will apply the reloaded certificate is returned. If no reload
+// action is necessary, then nil is returned for the reload function.
+func (s *Service) VerifyReloadTLSCertificate() (func() error, error) {


Same thing as CertLoader.VerifyReload. Is this the best name for the method?

MakeTlsCertLoaderFunc??? Just a suggestion.

davidby-influx

A few suggestions, questions, comments...

cmd/influxd/run/command.go

davidby-influx · 2025-11-25T00:41:41Z

cmd/influxd/main.go

+
 		cmd.Logger.Info("Signal received, initializing clean shutdown...")
-		if sig == syscall.SIGTERM && cmd.Server.LogQueriesOnTermination() {
+		if logQueries && cmd.Server.LogQueriesOnTermination() {


Do we need the logQueries variable? Is there a case where we get here with a signal on shutdownCh that is not a SIGTERM?

shutdownCh will also get SIGINT (os.Interrupt) signals. We only log the queries on SIGTERM. Changes in the logic now that we are handling SIGHUP were easier (and clearer) by adding logQueries.

davidby-influx · 2025-11-25T00:45:06Z

pkg/file/file.go

+
+// VerifyFilePermissivenessF checks if permissions on f are as restrictive
+// or more restrictive than maxPerms. if not, then an error is returned.
+// For security reasons, there is no VerifyFilePermissiveness functino


Will be fixed in next commit.

davidby-influx · 2025-11-25T00:48:34Z

pkg/file/file_test.go

+
+		f, err := os.Open(tmpFile)
+		require.NoError(t, err)
+		defer f.Close()


Wrap in a require.NoError?

Will be fixed in next commit.

davidby-influx · 2025-11-25T00:49:48Z

pkg/file/file_test.go

+
+		f, err := os.Open(tmpFile)
+		require.NoError(t, err)
+		defer f.Close()


require.NoError?

Next commit.

davidby-influx · 2025-11-27T01:02:46Z

services/httpd/service_test.go

+			HTTPSEnabled: false,
+		}
+		applyFunc, err := s.VerifyReloadedConfig(newConfig)
+		require.Error(t, err)


This differs from usage elsewhere in this PR. Does require.ErrorContains imply require.Error? Or do you need to add require.Error to the other places?

Unnecessary require.Error will be removed in next commit.

davidby-influx · 2025-11-27T01:03:20Z

services/httpd/service_test.go

+			HTTPSPrivateKey:  ss.KeyPath,
+		}
+		applyFunc, err := s.VerifyReloadedConfig(newConfig)
+		require.Error(t, err)


See comment above

Fixed in next commit.

davidby-influx · 2025-11-27T01:03:40Z

services/httpd/service_test.go

+
+		// Open service to initialize certLoader
+		require.NoError(t, s.Open())
+		defer s.Close()


Any possible error?

Fixed in next commit.

davidby-influx · 2025-11-27T01:05:14Z

services/httpd/service_test.go

+
+		// Open service to initialize certLoader
+		require.NoError(t, s.Open())
+		defer s.Close()


any possible error?

Fixed in next commit.

davidby-influx · 2025-11-27T01:07:17Z

services/opentsdb/service.go

+// VerifyReloadTLSCertificate verifies that the configured TLS certificate can be reloaded.
+// If so, then a function that will apply the reloaded certificate is returned. If no reload
+// action is necessary, then nil is returned for the reload function.
+func (s *Service) VerifyReloadTLSCertificate() (func() error, error) {


MakeTlsCertLoaderFunc??? Just a suggestion.

- Correct race conditions present in httpd.Service. - Improve error messages. - Rename some methods for clarity. - Fix issues in tests. - Fix comments.

davidby-influx

LGTM.

I like the spelling corrections...

davidby-influx · 2025-12-23T19:56:29Z

cmd/influxd/run/command.go

+	config, err := cmd.ParseConfig(configPath)
 	if err != nil {
-		return fail(fmt.Errorf("error parsing config file: %s", err))
+		return fail(fmt.Errorf("error parsing config file (%q): %s", configPath, err))


davidby-influx · 2025-12-23T19:57:30Z

pkg/tlsconfig/certconfig.go

 		if err := cl.setCertificate(loadedCert); err != nil {
 			// There shouldn't be a way to get here.
-			log.Error("error setting certificate after load")
+			log.Error("error setting certificate after load", zap.Error(err))


Add TLS certificate reloading on SIGHUP. For httpd service certificates, the configuration is reloaded and certificate and key file locations are updated accordingly. For opentsdb service certificates, certificates and keys at the existing locations are reloaded. If reloading a certificate fails, the currently loaded certificate continues to be used. Also adds file permission checking for TLS certificates and private keys. Clean cherry-pick of #26994 to 1.12. Closes: #27056 (cherry picked from commit 8c9b850)

gwossum added 2 commits November 18, 2025 13:21

chore: rewrite some tests to get certificates without tricks

82a891a

Rewrite some tests so that tricks are not used to get a hold of the TLS certificate in-use. Instead, an HTTP client is used to get the certificate presented by the http service.

gwossum self-assigned this Nov 24, 2025

gwossum added security 1.x team/edge labels Nov 24, 2025

gwossum commented Nov 24, 2025

View reviewed changes

pkg/tlsconfig/tls_config.go Show resolved Hide resolved

gwossum commented Nov 24, 2025

View reviewed changes

davidby-influx requested changes Nov 27, 2025

View reviewed changes

fix: correct race conditions in httpd.Service

878d6d5

- Correct race conditions present in httpd.Service. - Improve error messages. - Rename some methods for clarity. - Fix issues in tests. - Fix comments.

davidby-influx approved these changes Dec 23, 2025

View reviewed changes

gwossum merged commit 8c9b850 into master-1.x Dec 23, 2025
9 checks passed

gwossum deleted the gw/tls_cert_omnibus branch December 23, 2025 20:29

gwossum mentioned this pull request Dec 23, 2025

1.x: Port to feat: add TLS certificate reloading on SIGHUP to 1.12 #27056

Closed

gwossum mentioned this pull request Dec 23, 2025

feat: add TLS certificate reloading on SIGHUP #27057

Merged

feat: add TLS certificate reloading on SIGHUP #26994

feat: add TLS certificate reloading on SIGHUP #26994

Conversation

gwossum commented Nov 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

davidby-influx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

davidby-influx left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants