You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "ChinmayHegde24 (via GitHub)" <gi...@apache.org> on 2025/09/22 11:00:45 UTC
[PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
ChinmayHegde24 opened a new pull request, #680:
URL: https://github.com/apache/ranger/pull/680
Master Key name is hard coded for Ranger KMS DB integration with Luna HSM.
Refer : https://github.com/apache/ranger/blob/master/kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java#L50
It is made configurable so CU can provide customised name.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "ChinmayHegde24 (via GitHub)" <gi...@apache.org>.
ChinmayHegde24 commented on PR #680:
URL: https://github.com/apache/ranger/pull/680#issuecomment-4335917440
> @ChinmayHegde24 , can you pls update the cases you have tested for this patch ? It would be helpful to review this PR.
Yeah please check it once now @vikaskr22
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "vikaskr22 (via GitHub)" <gi...@apache.org>.
vikaskr22 merged PR #680:
URL: https://github.com/apache/ranger/pull/680
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "ChinmayHegde24 (via GitHub)" <gi...@apache.org>.
ChinmayHegde24 commented on code in PR #680:
URL: https://github.com/apache/ranger/pull/680#discussion_r2390007804
##########
kms/config/kms-webapp/dbks-site.xml:
##########
@@ -405,6 +405,12 @@
<value>false</value>
<description></description>
</property>
+
+ <property>
+ <name>ranger.ks.hsm.masterkey.alias</name>
+ <value></value>
Review Comment:
@vikaskr22 During the luna client setup part where properties are set in CM, during that time the value(custom name) for this property needs to be updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "vikaskr22 (via GitHub)" <gi...@apache.org>.
vikaskr22 commented on PR #680:
URL: https://github.com/apache/ranger/pull/680#issuecomment-4335751613
@ChinmayHegde24 , can you pls update the cases you have tested for this patch ? It would be helpful to review this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "ChinmayHegde24 (via GitHub)" <gi...@apache.org>.
ChinmayHegde24 commented on code in PR #680:
URL: https://github.com/apache/ranger/pull/680#discussion_r2391991717
##########
kms/config/kms-webapp/dbks-site.xml:
##########
@@ -405,6 +405,12 @@
<value>false</value>
<description></description>
</property>
+
+ <property>
+ <name>ranger.ks.hsm.masterkey.alias</name>
+ <value></value>
Review Comment:
@vikaskr22 in that case value will be null not "" hence it will fallback to default alias.
But I'll move that default alias to xml property itself in order to be sync with other properties.
Thank you for pointing it out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "vikaskr22 (via GitHub)" <gi...@apache.org>.
vikaskr22 commented on code in PR #680:
URL: https://github.com/apache/ranger/pull/680#discussion_r2731766356
##########
kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java:
##########
@@ -155,7 +158,7 @@ public boolean setMasterKey(String password, byte[] key) {
try {
Key aesKey = new SecretKeySpec(key, MK_CIPHER);
- myStore.setKeyEntry(ALIAS, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
+ myStore.setKeyEntry(alias, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
Review Comment:
@ChinmayHegde24 , it's not related to your change. But it would be better to add one check to verify if the key alias already exists or not , the way we check in generateMasterKey() method.
@dhavalshah9131 , is there any reason there is no check for key existence ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "vikaskr22 (via GitHub)" <gi...@apache.org>.
vikaskr22 commented on code in PR #680:
URL: https://github.com/apache/ranger/pull/680#discussion_r2386979441
##########
kms/config/kms-webapp/dbks-site.xml:
##########
@@ -405,6 +405,12 @@
<value>false</value>
<description></description>
</property>
+
+ <property>
+ <name>ranger.ks.hsm.masterkey.alias</name>
+ <value></value>
Review Comment:
@ChinmayHegde24 , can you please confirm following :
In dbks-site.xml, you are keeping this as empty. And in RangerHSM.java, how will following behave:
this.alias = conf.get(MK_ALIAS, DEFAULT_ALIAS); ?
is it possible that it will initialise this.alias="" ? As per API , if this key doesn't exist, then default will be used. But here key will exist with empty value.
Pls check and confirm this case.
Other things look good to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "ChinmayHegde24 (via GitHub)" <gi...@apache.org>.
ChinmayHegde24 commented on code in PR #680:
URL: https://github.com/apache/ranger/pull/680#discussion_r2390007804
##########
kms/config/kms-webapp/dbks-site.xml:
##########
@@ -405,6 +405,12 @@
<value>false</value>
<description></description>
</property>
+
+ <property>
+ <name>ranger.ks.hsm.masterkey.alias</name>
+ <value></value>
Review Comment:
@vikaskr22 During the luna client setup part where properties are set in CM, during that time the value(custom name) for this property needs to be updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "vikaskr22 (via GitHub)" <gi...@apache.org>.
vikaskr22 commented on code in PR #680:
URL: https://github.com/apache/ranger/pull/680#discussion_r2731766356
##########
kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java:
##########
@@ -155,7 +158,7 @@ public boolean setMasterKey(String password, byte[] key) {
try {
Key aesKey = new SecretKeySpec(key, MK_CIPHER);
- myStore.setKeyEntry(ALIAS, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
+ myStore.setKeyEntry(alias, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
Review Comment:
@ChinmayHegde24 , it's not related to your change. But it would be better add one check to verify if the key alias already exists or not , the way we check in generateMasterKey() method.
@dhavalshah9131 , is there any reason there is no check for key existence ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM [ranger]
Posted by "vikaskr22 (via GitHub)" <gi...@apache.org>.
vikaskr22 commented on PR #680:
URL: https://github.com/apache/ranger/pull/680#issuecomment-4345089576
@kumaab , Above build-11 & plugin-docker-build is failing. Is it a known issue ? Can it be merged ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org