Mailing-List: contact hdfs-dev-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: hdfs-dev@hadoop.apache.org
MIME-Version: 1.0
In-Reply-To: 
 <CAGCyb56sMuQKPSDWtUJtX8nUT2c_LN_kLat8daqZWN4UVWMPkw@mail.gmail.com>
References: 
 <CAMnjchnsh41OgfLd9jXYO4YyzX3Bmktwc_98rm+Kz7xgjsgPFQ@mail.gmail.com>
	<CAGCyb56sMuQKPSDWtUJtX8nUT2c_LN_kLat8daqZWN4UVWMPkw@mail.gmail.com>
Date: Fri, 19 Jun 2015 14:37:32 +0530
Message-ID: 
 <CAMnjchkw0g8E2cNLm_ggPh-yJ0wmnFduS+wzpTubXgRHX5yymg@mail.gmail.com>
Subject: Re: Retrieving keys via KMS from map/reduce phase.
From: Sitaraman Vilayannur <vrsitaramanietflists@gmail.com>
To: hdfs-dev@hadoop.apache.org
Content-Type: multipart/alternative; boundary=001a113ee0501ad57d0518db41b7

--001a113ee0501ad57d0518db41b7
Content-Type: text/plain; charset=UTF-8

Thanks for the info Arun. I asked this question for a custom application of
mine wherein i
need to retrieve the key from MapReduce code. Is there a way that i can
replicate my keyprovider across
the data nodes and then access the local key provider from MR code at each
data node? If so what
method would be recommended to do this.
Sitaraman

On Fri, Jun 19, 2015 at 11:56 AM, Arun Suresh <asuresh@apache.org> wrote:

> You really do not need to talk to the KMS directly from the MR code.. The
> MR framework and the DFSClient will automatically decrypt for you when the
> mappers are reading a file (one of the reasons why this is called
> "transparent" data encryption). Similarly, files that are written to an
> output directory will be encrypted with the required key (if the output
> directory is contained within an encryption zone).
>
> But ofcourse, there is nothing stopping you from talking to the KMS
> directly from java code (using the KMSClientProvider). But most KMS
> deployments would restrict create key operations etc. for non-admin users.
>
> On Thu, Jun 18, 2015 at 6:56 PM, Sitaraman Vilayannur <
> vrsitaramanietflists@gmail.com> wrote:
>
> > Hi,
> >
> >   Using the key management system  will i be able to store  a set of keys
> > in my keystore and then retrieve those keys later based on their aliases
> > from within the map/reduce phase to do my encyrption/decryption
> activities
> > from map reduce?
> >
> > Thanks
> >
> > Sitaraman
> >
>

--001a113ee0501ad57d0518db41b7--