hyperledger / fabric-x-committer

91%

main: 91%

LAST BUILD ON BRANCH dynamic-tls

branch: dynamic-tls

CHANGE BRANCH

x

Reset

• dynamic-tls
• apt-ci-fix
• backoff-v5
• bccsp-race
• bench-report-metrics
• bft-delivery
• bob-rules
• buffer-race
• build-unify
• channel-race
• ci-gotestsum
• cli-refactor
• client-test-race
• client-tls-bug
• commit-config-immediately
• config-docs-yaml
• connection-test-dep
• coveralls
• cryptogen-recreate-support
• dedup-templ
• default-test-node-startup-setup
• default-viper
• deliver-check-block-order
• deliver-seek-tls-cert
• deliver-seek-tls-cert-fix
• dependabot/go_modules/go_modules-9c5197dcb8
• dependabot/go_modules/go_modules-d35c03d4db
• dependabot/go_modules/go_modules-eee72e131a
• dependencygraph-race
• deployment-strategy
• doc-loadgen-artifacts
• dynamic-root-ca
• enable-pprof
• expose-ledger-api
• external-server-config
• extract-prometheus-startup-and-grpc-server-start
• fabric-lib-go-v1.1.3
• fabric-logging
• fix-connection-reset
• fix-container-image
• fix-container-test-macos
• fix-db-test
• fix-falky-svmupdate-test
• fix-flaky
• fix-flaky-conn-metrics
• fix-flaky-loadgen-coord
• fix-master-tserver-rf
• fix-port-container-test
• fix-release-path
• fix-sign
• fix-test-node-with-insecure
• fix-test-wait
• fix-waiting-tx-count
• flaky-test-orderer
• getpeersmspdirs-no-hardcode
• go-fix
• grpc-logger-fix
• grpcservice-refactor
• healthz-check
• ledger-service-wait-behaviour
• lifecycle-policy
• limit-block-apis
• limit-inputs-block-apis
• load-config-block-certs
• loadgen-manual-msp
• loadgen-remove-ctx
• main
• make-ci-local
• make-fixes
• makefile-test-flags
• metrics-tls
• metrics-url-race
• migrate-to-postgres-official-image
• minimize-logs
• mkdocs
• mock-orderer-dynamic-tls
• mock-orderer-features
• mock-orderer-stream-holder
• mock-verifier-race
• move-retry-package
• namespace-policy-docs
• notifier-metrics
• optimize-map-block
• orderer-config-race
• pgx5
• postgres-renaming
• prom-refactor
• qs-pen-test-fix
• race-detection
• rate-limit-sidecar
• refactor-channel
• refactor-cmd
• refactor-test
• remove-ifrit-gomega
• rename
• rename-materials
• rename-util-files
• review-ai-prompt
• rm-gpl-tools
• rm-reployment
• rm-unused
• root-ca-workaround-fix
• sidecar-block-store-code-fix
• sidecar-limit-active-txids-notifier
• sidecar-race
• sidecar-remove-chan-id
• split-tablets
• sustain-config
• sync-block
• template-tls-per-endpoint
• test-container-port-binding
• test-coverage-connection
• test-coverage-improve
• test-coverage-latency
• test-coverage-tests
• test-limiter-max-wait
• test-minor-fixes
• test-query-status
• test-tls-flatten
• testcrypto-race
• testcrypto-refactor
• tls-docs-update
• update-common
• update-common-dep
• update-to-latest-common
• update-to-yugabytedb-latest-lts
• upgrade-pg
• vc-race
• verifier-test-remove-gomega
• worktree-notification-docs

Build # 24301730407

Build Type

Pull #530

github

Committed by cendhu

Commit Message

dynamic TLS CA rotation for sidecar and query service

Add dynamic TLS support so that peer organization CA certificates are
automatically updated when config blocks add or remove organizations.

- DynamicTLSManager in utils/connection/ watches config block updates
  and rebuilds the trusted CA pool on the fly
- Sidecar updates TLS immediately during config block processing
- Query service polls the DB periodically for config changes
- Integration test covers add/remove/restore of peer orgs with mTLS
- Infrastructure plumbing for QueryTLSRefreshInterval and
  PeerOrganizationCount in runner config

Signed-off-by: Senthilnathan <cendhu@gmail.com>

Pull Request Pull Request #530: dynamic TLS CA rotation for sidecar and query service

Coverage Stats

123 of 177 new or added lines in 10 files covered. (69.49%)

6 existing lines in 3 files now uncovered.

10159 of 11143 relevant lines covered (91.17%)

41964.59 hits per line