[HDFS-12400] Provide a way for NN to drain the local key cache before re-encryption

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-beta1
• Fix Version/s: 3.0.0-beta1
• Component/s: encryption
• Target Version/s: 3.0.0-beta1
• Hadoop Flags: Reviewed
• Assignee: Xiao Chen
• Reporter: Xiao Chen
• Created: 06/Sep/17 19:27
• Updated: 02/Oct/19 17:12
• Resolved: 08/Sep/17 03:52

Description

In HDFS-12359, a fix for the KMS ACLs required for re-encryption was done. As part of the fix, the following code is used to make sure the local provider cache in the NN is drained.

if (dir.getProvider() instanceof CryptoExtension) {
  ((CryptoExtension) dir.getProvider()).drain(keyName);
}

This doesn't work, because the provider is KeyProviderCryptoExtension instead of CryptoExtension - the latter is composite of the former.

Unfortunately unit test didn't catch this, because it conveniently rolled the from the NN's provider.

Issue Links

• is broken by: HDFS-12359 Re-encryption should operate with minimum KMS ACL requirements.