Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Fri, 3 Mar 2017 18:48:45 +0000 (UTC)
From: "Daryn Sharp (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.13045338.1487790563000.57518.1488566925304@Atlassian.JIRA>
In-Reply-To: <JIRA.13045338.1487790563000@Atlassian.JIRA>
References: <JIRA.13045338.1487790563000@Atlassian.JIRA> <JIRA.13045338.1487790563127@jira-lw-us.apache.org>
Subject: [jira] [Commented] (HADOOP-14104) Client should always ask namenode
 for kms provider path.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 03 Mar 2017 18:48:50 -0000


    [ https://issues.apache.org/jira/browse/HADOOP-14104?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15894839#comment-15894839 ] 

Daryn Sharp commented on HADOOP-14104:
--------------------------------------

Credentials are simply a container in the ugi for tokens and/or secrets.  There is no notion of client, server, etc.  Credentials are the mechanism by which tokens are propagated throughout a job.

I may be understanding the EZ w/o security question (which seems an entirely contrived use case), but regardless: if tokens are available, so are the secrets since they are both packaged in the credentials object.  If this use case works today then it will continue to work with the mappings based approach.

> Client should always ask namenode for kms provider path.
> --------------------------------------------------------
>
>                 Key: HADOOP-14104
>                 URL: https://issues.apache.org/jira/browse/HADOOP-14104
>             Project: Hadoop Common
>          Issue Type: Improvement
>          Components: kms
>            Reporter: Rushabh S Shah
>            Assignee: Rushabh S Shah
>         Attachments: HADOOP-14104-trunk.patch, HADOOP-14104-trunk-v1.patch
>
>
> According to current implementation of kms provider in client conf, there can only be one kms.
> In multi-cluster environment, if a client is reading encrypted data from multiple clusters it will only get kms token for local cluster.
> Not sure whether the target version is correct or not.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org