Reload the TLS certificate without a restart
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start with cmd/fanout/main.go and internal/server/http.go to trace how TLS is configured, then read internal/server/clientca.go and the TLS guide at site/src/content/docs/docs/guides/tls.mdx. Check the existing server tests for certificate loading and connection behavior. Done when the acceptance criteria pass, including keeping the last good certificate on invalid or mismatched file updates, and the TLS guide explains the client CA restart requirement.
由索引模型根据 Issue 内容生成。
描述
What
Fanout reads FANOUT_TLS_CERT_FILE and FANOUT_TLS_KEY_FILE once, through ListenAndServeTLS, so a renewed certificate needs a restart. A restart interrupts ingest on a single-node product, and anyone renewing with certbot or a similar tool hits this at every renewal.
Serve the certificate through a tls.Config.GetCertificate callback that picks up changed files, with no new settings.
Acceptance criteria
- A new handshake uses the renewed certificate after the files change, with no restart
- Existing connections, including long-lived gRPC streams, are not dropped by a reload
- A partial or invalid pair on disk keeps the last good certificate and logs an error that names the path, never file contents
- A cert and key written at slightly different times never produce a mismatched pair
- Startup still fails on an unreadable or invalid pair
- TLS 1.3, ALPN
h2, andFANOUT_TLS_CLIENT_CA_FILEbehave as before - The file check does not add file reads to every handshake without a bound
- TLS guide updated, including that the client CA bundle still needs a restart
References
cmd/fanout/main.go(ListenAndServeTLS)internal/server/http.gointernal/server/clientca.gosite/src/content/docs/docs/guides/tls.mdx
One pull request. Use the latest stable version of any dependency added, verified against its registry and pinned exactly.
- 主要语言
- Go
- 星标
- 11
- 派生
- 0
- 平均合并
- 7 小时 5 分钟
- 30 天内合并 PR
- 112
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
labstack/fanout 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 58/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 57/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
rancher/rancher-ai-mcp#206 ·
维护者通常 1 天内回复
-
test: make command and stdio startup tests portable可能已有人在做 @dajiaohuang 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 73/100
mark3labs/mcp-go#1220 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 75/100
-
bug
难度 2/5 1-3 小时 新手友好度 85/100
open-telemetry/opentelemetry-go-compile-instrumentation#1743 ·
维护者通常 2 天内回复
-
FindInBatches panics for non-positive batch sizes可能已有人在做 @Dazhou-del 今天认领。 未关闭type:with reproduction steps
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复