HBASE-28911: Automatic SSL keystore reloading for HttpServer

implement the same as HADOOP-16524

Author: eubnara

hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java

@@ -35,6 +35,8 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
+import java.util.Timer;
 import java.util.stream.Collectors;
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -62,6 +64,8 @@
 import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
 import org.apache.hadoop.security.authorize.AccessControlList;
 import org.apache.hadoop.security.authorize.ProxyUsers;
+import org.apache.hadoop.security.ssl.FileBasedKeyStoresFactory;
+import org.apache.hadoop.security.ssl.FileMonitoringTimerTask;
 import org.apache.hadoop.util.Shell;
 import org.apache.hadoop.util.StringUtils;
 import org.apache.yetus.audience.InterfaceAudience;
@@ -179,6 +183,7 @@ public class HttpServer implements FilterContainer {
       .build();
 
   private final AccessControlList adminsAcl;
+  private final Optional<Timer> configurationChangeMonitor;
 
   protected final Server webServer;
   protected String appDir;
@@ -244,6 +249,8 @@ public static class Builder {
     private String kerberosNameRulesKey;
     private String signatureSecretFileKey;
 
+    private Optional<Timer> configurationChangeMonitor = Optional.empty();
+
     /**
      * @see #setAppDir(String)
      * @deprecated Since 0.99.0. Use builder pattern via {@link #setAppDir(String)} instead.
@@ -466,6 +473,15 @@ public HttpServer build() throws IOException {
             LOG.debug("Excluded SSL Cipher List:" + excludeCiphers);
           }
 
+          long storesReloadInterval =
+            conf.getLong(FileBasedKeyStoresFactory.SSL_STORES_RELOAD_INTERVAL_TPL_KEY,
+              FileBasedKeyStoresFactory.DEFAULT_SSL_STORES_RELOAD_INTERVAL);
+
+          if (storesReloadInterval > 0 && (keyStore != null || trustStore != null)) {
+            this.configurationChangeMonitor =
+              Optional.of(this.makeConfigurationChangeMonitor(storesReloadInterval, sslCtxFactory));
+          }
+
           listener = new ServerConnector(server.webServer,
             new SslConnectionFactory(sslCtxFactory, HttpVersion.HTTP_1_1.toString()),
             new HttpConnectionFactory(httpsConfig));
@@ -496,6 +512,29 @@ public HttpServer build() throws IOException {
 
     }
 
+    private Timer makeConfigurationChangeMonitor(long reloadInterval,
+        SslContextFactory.Server sslContextFactory) {
+      Timer timer = new Timer("SSL Certificates Store Monitor", true);
+      //
+      // The Jetty SSLContextFactory provides a 'reload' method which will reload both
+      // truststore and keystore certificates.
+      //
+      timer.schedule(new FileMonitoringTimerTask(
+              Paths.get(keyStore),
+              path -> {
+                LOG.info("Reloading certificates from store keystore " + keyStore);
+                try {
+                  sslContextFactory.reload(factory -> { });
+                } catch (Exception ex) {
+                  LOG.error("Failed to reload SSL keystore certificates", ex);
+                }
+              },null),
+          reloadInterval,
+          reloadInterval
+      );
+      return timer;
+    }
+
   }
 
   /**
@@ -602,6 +641,7 @@ private HttpServer(final Builder b) throws IOException {
     this.authenticationEnabled = b.securityEnabled;
     initializeWebServer(b.name, b.hostName, b.conf, b.pathSpecs, b);
     this.webServer.setHandler(buildGzipHandler(this.webServer.getHandler()));
+    this.configurationChangeMonitor = b.configurationChangeMonitor;
   }
 
   private void initializeWebServer(String name, String hostName, Configuration conf,
@@ -1291,6 +1331,15 @@ void openListeners() throws Exception {
    */
   public void stop() throws Exception {
     MultiException exception = null;
+    if (this.configurationChangeMonitor.isPresent()) {
+      try {
+        this.configurationChangeMonitor.get().cancel();
+      } catch (Exception e) {
+        LOG.error("Error while canceling configuration monitoring timer for webapp"
+          + webAppContext.getDisplayName(), e);
+        exception = addMultiException(exception, e);
+      }
+    }
     for (ListenerInfo li : listeners) {
       if (!li.isManaged) {
         continue;