[HADOOP-13597] Switch KMS from Tomcat to Jetty

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 3.0.0-alpha2
• Component/s: kms
• Target Version/s: 3.0.0-alpha2
• Hadoop Flags: Incompatible change, Reviewed

Release Note

<!-- markdown -->

The following environment variables are deprecated. Set the corresponding
configuration properties instead.

Environment Variable | Configuration Property | Configuration File
-------------------------|------------------------------|--------------------
KMS_HTTP_PORT | hadoop.kms.http.port | kms-site.xml
KMS_MAX_HTTP_HEADER_SIZE | hadoop.http.max.request.header.size and hadoop.http.max.response.header.size | kms-site.xml
KMS_MAX_THREADS | hadoop.http.max.threads | kms-site.xml
KMS_SSL_ENABLED | hadoop.kms.ssl.enabled | kms-site.xml
KMS_SSL_KEYSTORE_FILE | ssl.server.keystore.location | ssl-server.xml
KMS_SSL_KEYSTORE_PASS | ssl.server.keystore.password | ssl-server.xml
KMS_TEMP | hadoop.http.temp.dir | kms-site.xml

These default HTTP Services have been added.

Name | Description
-------------------|------------------------------------
/conf | Display configuration properties
/jmx | Java JMX management interface
/logLevel | Get or set log level per class
/logs | Display log files
/stacks | Display JVM stacks
/static/index.html | The static home page

The JMX path has been changed from /kms/jmx to /jmx.

Script kms.sh has been deprecated, use `hadoop kms` instead. The new scripts are based on the Hadoop shell scripting framework. `hadoop daemonlog` is supported. SSL configurations are read from ssl-server.xml.

• Assignee: John Zhuge
• Reporter: John Zhuge
• Created: 13/Sep/16 05:09
• Updated: 07/Jan/20 09:08
• Resolved: 06/Jan/17 01:24

Description

The Tomcat 6 we are using will reach EOL at the end of 2017. While there are other good options, I would propose switching to Jetty 9 for the following reasons:

• Easier migration. Both Tomcat and Jetty are based on Servlet Containers, so we don't have change client code that much. It would require more work to switch to JAX-RS.
• Well established.
• Good performance and scalability.

Other alternatives:

• Jersey + Grizzly
• Tomcat 8

Your opinions will be greatly appreciated.

Issue Links

• blocks: HADOOP-15698 KMS log4j is not initialized properly at startup
• breaks: HADOOP-13961 Fix compilation failure from missing hadoop-kms test jar
• breaks: HADOOP-15696 KMS performance regression due to too many open file descriptors after Jetty migration
• breaks: HADOOP-14317 KMSWebServer$deprecateEnv may leak secret
• breaks: HADOOP-15638 KMS Accept Queue Size default changed from 500 to 128 in Hadoop 3.x
• breaks: HADOOP-14608 KMS JMX servlet path not backwards compatible
• causes: HDFS-15097 Purge log in KMS and HttpFS
• depends upon: HADOOP-10075 Update jetty dependency to version 9
• is depended upon by: HADOOP-14047 Require admin to access KMS instrumentation servlets
• is depended upon by: HDFS-10860 Switch HttpFS from Tomcat to Jetty
• is depended upon by: HADOOP-13875 HttpServer2 should support more SSL configuration properties
• is depended upon by: HADOOP-13955 Replace deprecated HttpServer2 and SSLFactory constants
• is depended upon by: HADOOP-13990 Document KMS usage of CredentialProvider API
• is depended upon by: HADOOP-14340 Enable KMS and HttpFS to exclude SSL ciphers
• is depended upon by: HADOOP-14352 Make some HttpServer2 SSL properties optional
• is depended upon by: HADOOP-14367 Remove unused setting from pom.xml
• is depended upon by: HADOOP-14375 Remove tomcat support from hadoop-functions.sh
• is duplicated by: HADOOP-13872 KMS JMX exception
• is related to: HADOOP-13992 KMS should load SSL configuration the same way as SSLFactory
• is related to: HADOOP-11070 Create MiniKMS for testing
• supercedes: HADOOP-12809 Move to tomcat 8.0.21 to support different passwords for key and keystore on HTTPFS/KMS using SSL