Solr keystore property renames

[epugh]

https://issues.apache.org/jira/browse/SOLR-17864

solr.keyStoreReload.enabled -> solr.keystore.reload.enabled
solr.jetty.sslContext.reload.scanInterval --> solr.jetty.ssl.context.reload.scan.interval.secs

A question... We already have a environment variable SOLR_SSL_RELOAD_ENABLED that controls the setting of solr.keystore.reload.enabled. Should we just call it solr.ssl.reload.enabled? Or maybe chnage the environment variable to SOLR_KEYSTORE_RELOAD_ENABLED?

[epugh]

Hey @tflobbe in the docs for security it says the reload of keys is on by default, but I don't see that. In Http2SolrClient I do see this logic:

Long keyStoreReloadIntervalSecs = builder.keyStoreReloadIntervalSecs;
    if (keyStoreReloadIntervalSecs == null
        && EnvUtils.getPropertyAsBool("solr.keystore.reload.enabled", false)) {
      keyStoreReloadIntervalSecs =
          EnvUtils.getPropertyAsLong("solr.jetty.ssl.context.reload.scan.interval.secs", 30l);
    }

[epugh]

I don't like that solr.jetty.ssl.verify.client.hostname=HTTPS is what the start scripts do... When in jetty-ssl.xml we are populating EndpointIdentificationAlgorithm. What about solr.jetty.ssl.verify.client.algorithm=HTTPS or solr.jetty.ssl.verification.algorithm=HTTPS?

[tflobbe]

Hey @tflobbe in the docs for security it says the reload of keys is on by default, but I don't see that. In Http2SolrClient I do see this logic:

It looks like the the solr start script will set the default to true here

I understand and agree with the goals of this Jira, but I do want to point out that we are losing some information by doing some of these changes. Today, the solr.jetty... are system properties that are taken verbatim from Jetty's config and docs, by changing some of them they aren't "mappable" to Jetty configs anymore.
Maybe the answer is "we don't care, we don't want Solr to be mapped directly to Jetty since it's a standalone app and Jetty is an implementation detail", which has been largely discussed. In such case, I wonder why keeping the word "jetty" in there.

[tflobbe]

I'm not sure I like removing the "idle", it makes the parameter confusing, as the user wouldn't know what kind of timeout this is (my first thought would be this is a request timeout)

[tflobbe]

Note that this timeout property is different than the new one you are adding, for the same thing