Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-18956

Zookeeper SSL/TLS support in ZKDelegationTokenSecretManager and ZKSignerSecretProvider

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 3.4.0
    • 3.4.0
    • common
    • Reviewed

    Description

      HADOOP-18709 added support for Zookeeper to communicate with SSL/TLS enabled in hadoop-common. With those changes we have the necessary parameters, that we need to set to enable SSL/TLS in a ZK Client. That change also did changes in ZKCuratorManager, so with that it is easy to set the SSL/TLS, for Yarn it was done in YARN-11468.

      In DelegationTokenAuthenticationFilter currently we are using CuratorFrameworkFactory, it'd be good to change it to use ZKCuratorManager and with that we should support SSL/TLS enablement.

      UPDATE

      So as I investigated this a bit more, it wouldn't be so easy to move to using ZKCuratorManager.
      DelegationTokenAuthenticationFilter uses ZK from two places: in ZKDelegationTokenSecretManager and in ZKSignerSecretProvider. In both places it uses CuratorFrameworkFactory, but the attributes and creation differentiates from ZKCuratorManager.

      In ZKDelegationTokenSecretManager it would be easy to add the new config and based on that create ZK with CuratorFrameworkFactory. But ZKSignerSecretProvider is in hadoop-auth module and with my change it would need hadoop-common, so it would introduce circular dependency between modules 'hadoop-auth' and 'hadoop-common'. I'm still working on a straightforward solution.

      Attachments

        Issue Links

          Activity

            People

              pifta István Fajth
              zitadombi Zita Dombi
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: