Hadoop HDFS
  1. Hadoop HDFS
  2. HDFS-6201

Get EncryptionKey from NN only if data transfer encryption is required

    Details

    • Type: Improvement Improvement
    • Status: Open
    • Priority: Major Major
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: security
    • Labels:
      None

      Description

      HDFS-5910 allowed data transfer encryption to be decided by custom logic based on the Ip address of client and datanode. This is on top of the dfs.encrypt.data.transfer flag.

      There are some invocations where encryptionkey is fetched first and the datanode is identified later. In these cases, encryptionkey is fetched after invoking the custom logic without the ip address of the datanode. This might result in fetching fetching encryptionkey when it is not required and vice versa.

      To correct this, a refactoring is required so that encryptionkey is fetched only when it is required.

      Per Arpit Agarwal on HDFS-5910

      For the usage in getDataEncryptionKey(), we can refactor to pass a functor as the encryption key to e.g. getFileChecksum. However I am okay with doing the refactoring in a separate change. We can leave the parameter-less overload of isTrusted for now and just use it fromgetEcnryptionKey and file a separate Jira to fix it.

        Issue Links

          Activity

            People

            • Assignee:
              Benoy Antony
              Reporter:
              Benoy Antony
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:

                Development