You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Gargi-jais11 (via GitHub)" <gi...@apache.org> on 2026/01/28 11:26:59 UTC
[PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Gargi-jais11 opened a new pull request, #303:
URL: https://github.com/apache/ozone-site/pull/303
## What changes were proposed in this pull request?
- System Internals -> Security -> Kerberos
- Remove the existing section "Tokens".
- Migrate from https://ozone.apache.org/docs/edge/security/secureozone.html the section about the kerberos configurations of Storage Container Manager, Ozone Manager, S3 Gateway
- And add the following content given in jira description: **Kerberos and SPNEGO in Apache Ozone**
## What is the link to the Apache Jira?
https://issues.apache.org/jira/browse/HDDS-14480
## How was this patch tested?
Check off which of the following tests were done on this change. If additional testing was done, please elaborate here as well.
- [ ] The CI checks on my fork are passing
- [ ] I verified the rendered content using a local preview
- [ ] I manually verified the steps provided in this change work as described
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "sarvekshayr (via GitHub)" <gi...@apache.org>.
sarvekshayr merged PR #303:
URL: https://github.com/apache/ozone-site/pull/303
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "Gargi-jais11 (via GitHub)" <gi...@apache.org>.
Gargi-jais11 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745173200
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
+
+### Ozone Manager
+
+Like SCM, OM also requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `ozone.om.kerberos.principal` | `OM/_HOST@REALM` | The OzoneManager service principal. e.g. `om/_HOST@REALM.COM` |
+| `ozone.om.kerberos.keytab.file` | `/etc/security/keytabs/OM.keytab` | The keytab file used by OM daemon to login as its service principal. |
+| `ozone.om.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | Ozone Manager HTTP server service principal if SPNEGO is enabled for OM HTTP server. |
+| `ozone.om.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by OM HTTP server to login as its service principal if SPNEGO is enabled for OM HTTP server. |
+
+### S3 Gateway
+
+S3 Gateway requires **one service principal** and here the configuration values needed in the `ozone-site.xml`.
+
+| Property | Default Value | Description |
+| ---------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------- |
+| `ozone.s3g.kerberos.principal` | `s3g/_HOST@REALM` | S3 Gateway principal. e.g. `s3g/_HOST@REALM` |
+| `ozone.s3g.kerberos.keytab.file` | `/etc/security/keytabs/s3g.keytab` | The keytab file used by S3 Gateway. e.g. `/etc/security/keytabs/s3g.keytab` |
+| `ozone.s3g.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | S3 Gateway principal if SPNEGO is enabled for S3 Gateway HTTP server. e.g. `HTTP/_HOST@EXAMPLE.COM` |
+| `ozone.s3g.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by S3 Gateway if SPNEGO is enabled for S3 Gateway HTTP server. |
Review Comment:
All the values are there in `ozone-default.xml` in apache/ozone repo.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "sarvekshayr (via GitHub)" <gi...@apache.org>.
sarvekshayr commented on PR #303:
URL: https://github.com/apache/ozone-site/pull/303#issuecomment-3822819960
Thanks @Gargi-jais11 for the patch, @chungen0126 and @rich7420 for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "chungen0126 (via GitHub)" <gi...@apache.org>.
chungen0126 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745060677
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
+
+### Ozone Manager
+
+Like SCM, OM also requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `ozone.om.kerberos.principal` | `OM/_HOST@REALM` | The OzoneManager service principal. e.g. `om/_HOST@REALM.COM` |
+| `ozone.om.kerberos.keytab.file` | `/etc/security/keytabs/OM.keytab` | The keytab file used by OM daemon to login as its service principal. |
+| `ozone.om.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | Ozone Manager HTTP server service principal if SPNEGO is enabled for OM HTTP server. |
+| `ozone.om.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by OM HTTP server to login as its service principal if SPNEGO is enabled for OM HTTP server. |
Review Comment:
These, too.
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
+
+### Ozone Manager
+
+Like SCM, OM also requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `ozone.om.kerberos.principal` | `OM/_HOST@REALM` | The OzoneManager service principal. e.g. `om/_HOST@REALM.COM` |
+| `ozone.om.kerberos.keytab.file` | `/etc/security/keytabs/OM.keytab` | The keytab file used by OM daemon to login as its service principal. |
+| `ozone.om.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | Ozone Manager HTTP server service principal if SPNEGO is enabled for OM HTTP server. |
+| `ozone.om.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by OM HTTP server to login as its service principal if SPNEGO is enabled for OM HTTP server. |
+
+### S3 Gateway
+
+S3 Gateway requires **one service principal** and here the configuration values needed in the `ozone-site.xml`.
+
+| Property | Default Value | Description |
+| ---------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------- |
+| `ozone.s3g.kerberos.principal` | `s3g/_HOST@REALM` | S3 Gateway principal. e.g. `s3g/_HOST@REALM` |
+| `ozone.s3g.kerberos.keytab.file` | `/etc/security/keytabs/s3g.keytab` | The keytab file used by S3 Gateway. e.g. `/etc/security/keytabs/s3g.keytab` |
+| `ozone.s3g.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | S3 Gateway principal if SPNEGO is enabled for S3 Gateway HTTP server. e.g. `HTTP/_HOST@EXAMPLE.COM` |
+| `ozone.s3g.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by S3 Gateway if SPNEGO is enabled for S3 Gateway HTTP server. |
Review Comment:
These, too.
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
Review Comment:
These properties do not have a default value.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "Gargi-jais11 (via GitHub)" <gi...@apache.org>.
Gargi-jais11 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745176294
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
+
+### Ozone Manager
+
+Like SCM, OM also requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `ozone.om.kerberos.principal` | `OM/_HOST@REALM` | The OzoneManager service principal. e.g. `om/_HOST@REALM.COM` |
+| `ozone.om.kerberos.keytab.file` | `/etc/security/keytabs/OM.keytab` | The keytab file used by OM daemon to login as its service principal. |
+| `ozone.om.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | Ozone Manager HTTP server service principal if SPNEGO is enabled for OM HTTP server. |
+| `ozone.om.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by OM HTTP server to login as its service principal if SPNEGO is enabled for OM HTTP server. |
+
+### S3 Gateway
+
+S3 Gateway requires **one service principal** and here the configuration values needed in the `ozone-site.xml`.
+
+| Property | Default Value | Description |
+| ---------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------- |
+| `ozone.s3g.kerberos.principal` | `s3g/_HOST@REALM` | S3 Gateway principal. e.g. `s3g/_HOST@REALM` |
+| `ozone.s3g.kerberos.keytab.file` | `/etc/security/keytabs/s3g.keytab` | The keytab file used by S3 Gateway. e.g. `/etc/security/keytabs/s3g.keytab` |
+| `ozone.s3g.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | S3 Gateway principal if SPNEGO is enabled for S3 Gateway HTTP server. e.g. `HTTP/_HOST@EXAMPLE.COM` |
+| `ozone.s3g.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by S3 Gateway if SPNEGO is enabled for S3 Gateway HTTP server. |
Review Comment:
Let me know if still I need to remove these default values.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #303:
URL: https://github.com/apache/ozone-site/pull/303#issuecomment-3822139323
@rich742
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "chungen0126 (via GitHub)" <gi...@apache.org>.
chungen0126 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745271051
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
Review Comment:
This is a minor detail, but I would like to clarify it to avoid any misunderstandings in future.
Although these values appear in ozone-default.xml, they are not the defaults in the production code. Furthermore, as this file is not included in the release package, these configurations will not exist by default.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "rich7420 (via GitHub)" <gi...@apache.org>.
rich7420 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745124649
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
+
+### Ozone Manager
+
+Like SCM, OM also requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `ozone.om.kerberos.principal` | `OM/_HOST@REALM` | The OzoneManager service principal. e.g. `om/_HOST@REALM.COM` |
+| `ozone.om.kerberos.keytab.file` | `/etc/security/keytabs/OM.keytab` | The keytab file used by OM daemon to login as its service principal. |
+| `ozone.om.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | Ozone Manager HTTP server service principal if SPNEGO is enabled for OM HTTP server. |
+| `ozone.om.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab`| The keytab file used by OM HTTP server to login as its service principal if SPNEGO is enabled for OM HTTP server. |
+
+### S3 Gateway
+
+S3 Gateway requires **one service principal** and here the configuration values needed in the `ozone-site.xml`.
Review Comment:
```suggestion
S3 Gateway requires at least one Kerberos principal for the gateway service (`ozone.s3g.kerberos.principal` and `ozone.s3g.kerberos.keytab.file`). If SPNEGO is enabled for the S3 Gateway HTTP server, configure a second principal and keytab via `ozone.s3g.http.auth.kerberos.principal` and `ozone.s3g.http.auth.kerberos.keytab`. All of these are set in `ozone-site.xml`.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "chungen0126 (via GitHub)" <gi...@apache.org>.
chungen0126 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745271051
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
Review Comment:
This is a minor detail, but I would like to clarify it to avoid any misunderstandings in future.
Although these values appear in ozone-default.xml, they are not the defaults in the production code. Furthermore, as this file is not included in the release package, these configurations will not exist by default.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "chungen0126 (via GitHub)" <gi...@apache.org>.
chungen0126 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745286020
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
Review Comment:
My bad, I see them now in `ozone-default.xml`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "rich7420 (via GitHub)" <gi...@apache.org>.
rich7420 commented on PR #303:
URL: https://github.com/apache/ozone-site/pull/303#issuecomment-3822143687
Got it, I'll review this one
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "ss77892 (via GitHub)" <gi...@apache.org>.
ss77892 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2747078156
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -4,29 +4,56 @@ sidebar_label: Kerberos
# How Ozone Uses Kerberos
-## Tokens
+## 1. Kerberos
-Ozone uses a notion of tokens to avoid overburdening the Kerberos server. When you serve thousands of requests per second, involving Kerberos might not work well. Hence once an authentication is done, Ozone issues delegation tokens and block tokens to the clients. These tokens allow applications to do specified operations against the cluster, as if they have kerberos tickets with them. Ozone supports following kinds of tokens.
+Ozone depends on [Kerberos](https://web.mit.edu/kerberos/) to make the
+clusters secure. Historically, HDFS has supported running in an isolated
+secure networks where it is possible to deploy without securing the cluster.
Review Comment:
That's not true. Historically, HDFS has always relied on Kerberos. Almost every production deployment is using it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "ss77892 (via GitHub)" <gi...@apache.org>.
ss77892 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2747084157
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -4,29 +4,56 @@ sidebar_label: Kerberos
# How Ozone Uses Kerberos
-## Tokens
+## 1. Kerberos
-Ozone uses a notion of tokens to avoid overburdening the Kerberos server. When you serve thousands of requests per second, involving Kerberos might not work well. Hence once an authentication is done, Ozone issues delegation tokens and block tokens to the clients. These tokens allow applications to do specified operations against the cluster, as if they have kerberos tickets with them. Ozone supports following kinds of tokens.
+Ozone depends on [Kerberos](https://web.mit.edu/kerberos/) to make the
+clusters secure. Historically, HDFS has supported running in an isolated
+secure networks where it is possible to deploy without securing the cluster.
-### Delegation Token
+This release of Ozone follows that model, but soon will move to *secure by
Review Comment:
Not a good idea. At all.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14480. [Docs] System Internals -> Security -> Kerberos [ozone-site]
Posted by "Gargi-jais11 (via GitHub)" <gi...@apache.org>.
Gargi-jais11 commented on code in PR #303:
URL: https://github.com/apache/ozone-site/pull/303#discussion_r2745168322
##########
docs/07-system-internals/05-security/01-kerberos.md:
##########
@@ -53,6 +80,45 @@ If these are brand new Datanodes and Kerberos key tabs are not present at the Da
#### Automatic Approval
-If you running under an container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
+If you are running under a container orchestrator like Kubernetes, we rely on Kubernetes to create a one-time token that will be given to Datanode during boot time to prove the identity of the Datanode container (This is also work in progress.)
Once a certificate is issued, a Datanode is secure and Ozone Manager can issue block tokens. If there is no Datanode certificates or the SCM's root certificate is not present in the Datanode, then Datanode will register itself and download the SCM's root certificate as well get the certificates for itself.
+
+## 4. Kerberos Configurations for SCM, OM, and S3G
+
+### Storage Container Manager
+
+SCM requires **two Kerberos principals**, and the corresponding key tab files for both of these principals.
+
+| Property | Default Value | Description |
+| --------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `hdds.scm.kerberos.principal` | `SCM/_HOST@REALM` | The SCM service principal. e.g. `scm/_HOST@REALM.COM` |
+| `hdds.scm.kerberos.keytab.file` | `/etc/security/keytabs/SCM.keytab` | The keytab file used by SCM daemon to login as its service principal. |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` | SCM HTTP server service principal if SPNEGO is enabled for SCM HTTP server. |
+| `hdds.scm.http.auth.kerberos.keytab` | `/etc/security/keytabs/HTTP.keytab` | The keytab file used by SCM HTTP server to login as its service principal if SPNEGO is enabled for SCM HTTP server. |
Review Comment:
But I found these values in `ozone-default.xml`. Like these so I think these are default values only.
```
<property>
<name>hdds.scm.http.auth.kerberos.principal</name>
<value>HTTP/_HOST@REALM</value>
<tag>SCM, SECURITY, KERBEROS</tag>
<description>
SCM http server service principal if SPNEGO is enabled for SCM http server.
</description>
</property>
<property>
<name>hdds.scm.http.auth.kerberos.keytab</name>
<value>/etc/security/keytabs/HTTP.keytab</value>
<tag>SCM, SECURITY, KERBEROS</tag>
<description>
The keytab file used by SCM http server to login as its service
principal if SPNEGO is enabled for SCM http server.
</description>
</property>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org