[AMBARI-16717] Knox Gateway Uses Wrong Keystore After Upgrade

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.4.0
• Component/s: ambari-server
• Assignee: Jonathan Hurley
• Reporter: Jonathan Hurley
• Created: 17/May/16 22:33
• Updated: 18/May/16 20:35
• Resolved: 18/May/16 18:31

Description

When upgrading Knox, the data directory and its security artifacts are not copied over to the "versioned" data directory. This causes the gateway.jks keystore to be automatically re-generated. If the installation was using a custom keystore/certificate, then this will cause connections to be rejected after a successful startup.

Knox 2.2 -> 2.3.0.0

/usr/hdp/current/knox-server/data -> /var/lib/knox/data

Knox 2.3.2.0+

/usr/hdp/current/knox-server/data -> /var/lib/knox/data-2.3.2.0-1234

As a result, after upgrading the /var/lib/knox/data-2.3.2.0-1234 does not contain any of the security artifacts from the prior version.

Issue Links

• links to: Reviewboard