Mailing-List: contact hdfs-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Tue, 7 Feb 2017 09:42:41 +0000 (UTC)
From: "Xiao Chen (JIRA)" <jira@apache.org>
To: hdfs-issues@hadoop.apache.org
Message-ID: <JIRA.13025856.1481005945000.14578.1486460561701@Atlassian.JIRA>
In-Reply-To: <JIRA.13025856.1481005945000@Atlassian.JIRA>
References: <JIRA.13025856.1481005945000@Atlassian.JIRA> <JIRA.13025856.1481005945794@jira-lw-us.apache.org>
Subject: [jira] [Updated] (HDFS-11210) Enhance key rolling to guarantee new
 KeyVersion is returned from generateEncryptedKeys after a key is rolled
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Tue, 07 Feb 2017 09:42:45 -0000


     [ https://issues.apache.org/jira/browse/HDFS-11210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Xiao Chen updated HDFS-11210:
-----------------------------
    Attachment: HDFS-11210.04.patch

> Enhance key rolling to guarantee new KeyVersion is returned from generateEncryptedKeys after a key is rolled
> ------------------------------------------------------------------------------------------------------------
>
>                 Key: HDFS-11210
>                 URL: https://issues.apache.org/jira/browse/HDFS-11210
>             Project: Hadoop HDFS
>          Issue Type: Improvement
>          Components: encryption, kms
>    Affects Versions: 2.6.5
>            Reporter: Xiao Chen
>            Assignee: Xiao Chen
>         Attachments: HDFS-11210.01.patch, HDFS-11210.02.patch, HDFS-11210.03.patch, HDFS-11210.04.patch
>
>
> To support re-encrypting EDEK, we need to make sure after a key is rolled, no old version EDEKs are used anymore. This includes various caches when generating EDEK.
> This is not true currently, simply because no such requirements / necessities before.
> This includes
> - Client Provider(s), and corresponding cache(s).
> When LoadBalancingKMSCP is used, we need to clear all KMSCPs.
> - KMS server instance(s), and corresponding cache(s)
> When KMS HA is configured with multiple KMS instances, only 1 will receive the {{rollNewVersion}} request, we need to make sure other instances are rolled too.
> - The Client instance inside NN(s), and corresponding cache(s)
> When {{hadoop key roll}} is succeeded, the client provider inside NN should be drained too.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-help@hadoop.apache.org