hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Steve Loughran (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (HADOOP-14507) extend per-bucket secret key config with explicit getPassword() on fs.s3a.$bucket.secret,key
Date Tue, 07 Nov 2017 20:39:00 GMT

     [ https://issues.apache.org/jira/browse/HADOOP-14507?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Steve Loughran updated HADOOP-14507:
------------------------------------
    Attachment: HADOOP-14507-003.patch

 patch 002: 
* restore URI option to AWS providers; using this to bind to per-bucket keys whenever the
URI is passed in.
* Tests into TestSSEConfiguration due to common helper methods

Not done any integration testing; need to plan for setting all the options in various ways,
plus of course some doc changes.

Note that this isn't going to work with s3guard if its trying to bond from the s3guard cli
and you don't pass in a URI to a bucket: no bucket name == no per-bucket option, see. Same
as other per-bucket settings.

> extend per-bucket secret key config with explicit getPassword() on fs.s3a.$bucket.secret,key
> --------------------------------------------------------------------------------------------
>
>                 Key: HADOOP-14507
>                 URL: https://issues.apache.org/jira/browse/HADOOP-14507
>             Project: Hadoop Common
>          Issue Type: Sub-task
>          Components: fs/s3
>    Affects Versions: 2.8.1
>            Reporter: Steve Loughran
>            Assignee: Steve Loughran
>         Attachments: HADOOP-14507-001.patch, HADOOP-14507-002.patch, HADOOP-14507-003.patch
>
>
> Per-bucket jceks support turns out to be complex as you have to manage multiple jecks
files & configure the client to ask for the right one. This is because we're calling {{Configuration.getPassword{"fs,s3a.secret.key")}.

> If before that, we do a check for the explict id, key, session key in the properties
{{fs.s3a.$bucket.secret}} ( & c), we could have a single JCEKs file with all the secrets
for different bucket. You would only need to explicitly point the base config to the secrets
file, and the right credentials would be picked up, if set



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


Mime
View raw message