[KUDU-2252] Design and implement native encryption at rest

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.17.0
• Component/s: fs, security
• Labels: roadmap-candidate
• Assignee: Attila Bukor
• Reporter: Mike Percy
• Created: 09/Jan/18 04:32
• Updated: 15/Jun/23 18:42
• Resolved: 15/Jun/23 18:42

Description

It would be beneficial for Kudu to support native encryption at rest.

While the underlying filesystem can be encrypted with Kudu on top, there are benefits to native encryption at rest:

• With native encryption support, it may be possible to specify different encryption keys for different objects or object trees (such as is possible with HDFS encryption)
• It may be possible to share a single block device with other storage, including HDFS (note that some linux setups allow for "splitting" a device)

Sub-Tasks

• Support encryption in Env layer: Resolved
• Store encrypted encryption keys in encrypted files: Resolved
• Integrate encrypted Env: Resolved
• Encrypt file keys with server keys: Resolved
• Key provider interface with a default (test-only) implementation: Resolved
• Ranger KMS key provider: Resolved