On 24/09/2026 15:04, Mark Thomas wrote:
I'm making progress.
I have this working on my 4-node test cluster. It is currently limited
to static membership and TLS 1.2. I think both of those limitations can
be overcome.
Folks should be able to start testing this now.
My next steps are:
- get CoPilot to add TLSv1.3 support
TLSv1.3 support is complete. *Very* basic testing with my local 4-node
cluster instance identified some messages being dropped. That issue has
been fixed.
I tested behaviour with mismatched TLS configurations. The logs are very
noisy but I think that is OK. The cluster is broken in that situation so
noisy logs are appropriate.
- explore whether the static membership requirement can be dropped
This just worked. If a misconfigured node tries to join the cluster the
logs get very noisy (as they are with static membership). I think it is
OK but worth a note in the docs.
I'm planning to go through the docs this afternoon and then I should be
done for the TLS clustering support in 12.0.x pending review/feedback.
- do some more testing on a real cluster
- gives folks some time to review/test it themselves
^^^
These are the things this really needs next.
- back-port the changes
This needs either OpenSSL-FFM or Tomcat Native.
Once I'm happy I'm not going to need any more Native changes (likely
once TLS 1.3 support is working) I'll add a Tomcat Native release to my
TODO list.
There are likely some rough edges given how flexible cluster
configuration can be.
I'm thinking Tomcat Native 1.2.x release in October and back-port of the
TLS support no earlier than the November releases depending on how much
time folks have had to test this.
I'm going to try and get a Native release out in October ready for it to
be picked up by the November Tomcat releases. Whether we include the
TLS-PSK cluster support in November is TBD.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
