[HDFS-12359] Re-encryption should operate with minimum KMS ACL requirements.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-beta1
• Fix Version/s: 3.0.0-beta1
• Component/s: encryption
• Target Version/s: 3.0.0-beta1
• Hadoop Flags: Reviewed
• Assignee: Xiao Chen
• Reporter: Xiao Chen
• Created: 25/Aug/17 23:54
• Updated: 02/Oct/19 17:15
• Resolved: 05/Sep/17 17:08

Description

This was caught from KMS acl testing.

HDFS-10899 gets the current key versions from KMS directly, which requires READ acls.
It also calls invalidateCache, which requires MANAGEMENT acls.

We should fix re-encryption to not require additional ACLs than original encryption.

Issue Links

• breaks: HDFS-12400 Provide a way for NN to drain the local key cache before re-encryption
• is broken by: HDFS-10899 Add functionality to re-encrypt EDEKs