[IMPALA-7182] Impala does not allow the use of insecure clusters with public IPs by default

• Type: Task
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Impala 2.12.0
• Fix Version/s: Impala 3.1.0
• Component/s: Security
• Labels: docs security
• Epic Color: ghx-label-2
• Assignee: Alexandra Rodoni
• Reporter: Sailesh Mukil
• Created: 18/Jun/18 17:36
• Updated: 22/Feb/19 03:44
• Resolved: 18/Jun/18 23:56

Description

We made Impala more secure by using KRPC which doesn't allow the usage of insecure clusters (no auth or no encryption) with public IPs by default.

We have a workaround which is to add the subnet to this flag 'trusted_subnets':
https://github.com/apache/impala/blob/master/be/src/kudu/rpc/server_negotiation.cc#L70-L80

Although we don't expect users to run production environments with this configuration, we need to document this as it's a slight behavioral change from Impala 2.11 to Impala 2.12.