[HBASE-27342] Use Hadoop Credentials API to retrieve passwords of TLS key/trust stores

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.6.0, 3.0.0-alpha-4
• Component/s: IPC/RPC, security
• Labels: tls
• Assignee: Andor Molnar
• Reporter: Andor Molnar
• Created: 29/Aug/22 12:24
• Updated: 03/Oct/22 17:34
• Resolved: 01/Sep/22 08:06

Description

Based on a discussion in the TLS Jira and mailing list, it would be beneficial to protect the password of trust and key stores for TLS encryption support in Netty RPC.

Hadoop Credentials API is built for the same purpose, extensible and simple to use:

https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-common/CredentialProviderAPI.html

 

Issue Links

• is related to: HBASE-26666 Add native TLS encryption support to RPC server/client
• links to: GitHub Pull Request #4747
• links to: GitHub Pull Request #4751