Get Started

Switching a cluster to HTTPS

View as Markdown

Here’s a quick sequence with detailed comments inline.

But first:

Operational note: As with any cluster-wide configuration change that rebuilds cluster metadata (e.g., cluster map a.k.a. Smap), it is good practice to periodically back up cluster-level metadata (BMD, Smap, configuration). This is not specific to HTTP <=> HTTPS.

From HTTP to HTTPS

This assumes that X.509 certificate already exists and the (HTTP-based) cluster is up and running. All we need to do at this point is switch it to HTTPS.

1# step 1: configure certificate paths and verification
2$ ais config cluster net.http.server_key <path-to-cert>/cert.key net.http.server_crt <path-to-cert>/cert.crt
3$ ais config cluster net.http.skip_verify true
4
5# step 2: reconfigure cluster to use HTTPS
6$ ais config cluster net.http.use_https true
7
8# step 3: shutdown
9$ ais cluster shutdown
10
11# step 4: remove cluster map - all copies at all possible locations, for example:
12$ find ~/.ais* -type f -name ".ais.smap" | xargs rm
13
14# step 5: restart
15$ make kill cli deploy <<< $'6\n6\n4\ny\ny\nn\n'
16
17# step 6: optionally, run aisloader
18$ AIS_ENDPOINT=https://localhost:8080 aisloader -bucket=ais://nnn -cleanup=false -numworkers=8 -pctput=0 -randomproxy
19
20# step 7: optionally, reconfigure CLI to skip X.509 verification:
21$ ais config cli set cluster.skip_verify_crt true
22
23# step 8: run CLI
24$ AIS_ENDPOINT=https://127.0.0.1:8080 ais show cluster
25
26$ AIS_ENDPOINT=https://127.0.0.1:8080 ais archive gen-shards "ais://abc/shard-{001..999}.tar.lz4"
27Shards created: 999/999 [==============================================================] 100 %
28
29$ export AIS_ENDPOINT=https://localhost:8080
30
31$ ais ls ais://abc --summary
32NAME           PRESENT         OBJECTS         SIZE (apparent, objects, remote)        USAGE(%)
33ais://abc      yes             999 0           5.86MiB 5.20MiB 0B                      0%
34...
35...

NOTE: localhost:8080 (above) can be replaced with any legitimate (http or https) address of any AIS gateway. The latter may - but not necessarily have to - be specified with the environment variable AIS_ENDPOINT.

From HTTPS back to HTTP

1# step 1: disable HTTPS
2$ AIS_ENDPOINT=https://127.0.0.1:8080 ais config cluster net.http.use_https false
3
4# Note: certificate paths can only be cleared _after_ setting `use_https=false`
5
6# step 2: shutdown (notice that we are still using HTTPS endpoint)
7$ AIS_ENDPOINT=https://127.0.0.1:8080 ais cluster shutdown -y
8
9# step 3: remove cluster maps
10$ find ~/.ais* -type f -name ".ais.smap" | xargs rm
11
12# step 4: restart
13$ make kill cli deploy <<< $'6\n6\n4\ny\ny\nn\n'
14
15# step 5: and use
16$ ais show cluster