[HADOOP-14951] KMSACL implementation is not configurable

• Type: Improvement
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Component/s: kms
• Labels: key-management kms
• Flags: Patch
• Assignee: Zsombor Gegesy
• Reporter: Zsombor Gegesy
• Created: 16/Oct/17 15:03
• Updated: 04/Sep/19 17:26

Description

Currently, it is not possible to customize KMS's key management, if KMSACLs behaviour is not enough. If an external key management solution is used, that would need a higher level API, where it can decide, if the given operation is allowed, or not.
For this to achieve, it would be a solution, to introduce a new interface, which could be implemented by KMSACLs - and also other KMS - and a new configuration point could be added, where the actual interface implementation could be specified.

Issue Links

• blocks: RANGER-1869 KMS has duplicated code from Hadoop KMS
• is related to: HADOOP-15381 KmsAcls should be reloaded periodically.
• links to: GitHub Pull Request #664