[HIVE-23045] Zookeeper SSL/TLS support

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 4.0.0-alpha-1
• Component/s: HiveServer2, JDBC, Metastore
• Labels: pull-request-available
• Assignee: Peter Varga
• Reporter: Peter Varga
• Created: 18/Mar/20 10:03
• Updated: 17/Nov/22 08:50
• Resolved: 26/Mar/20 11:17

Description

Zookeeper 3.5.5 server can operate with SSL/TLS secure connection with its clients.

https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide

The SSL communication should be possible in the different part of HIVE, where it communicates with Zookeeper servers. The Zookeeper clients are used in the following places:

• HiveServer2 PrivilegeSynchronizer
• HiveServer2 register/remove server from Zookeeper
• HS2ActivePassiveHARegistryClient
• ZooKeeperHiveLockManager
• LLapZookeeperRegistryImpl
• TezAmRegistryImpl
• WebHCat ZooKeeperStorage
• JDBC Driver server lookup
• Metastore - ZookeeperTokenStore
• Metastore register/remove server from Zookeeper

The flag to enable SSL communication and the required parameters should be provided by different configuration parameters, corresponding the different use cases. 

Issue Links

• causes: HIVE-23715 Fix zookeeper ssl keystore password handling issues
• links to: GitHub Pull Request #958
• links to: rb