You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "jojochuang (via GitHub)" <gi...@apache.org> on 2025/05/30 18:04:43 UTC
[PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
jojochuang opened a new pull request, #8530:
URL: https://github.com/apache/ozone/pull/8530
## What changes were proposed in this pull request?
HDDS-13148. [Docs] Update Transparent Data Encryption doc.
Please describe your PR in detail:
* Generated-by: Google Gemini 2.5 Pro (Preview) with the following prompt:
```
I want to update the current Ozone's Transparent Data Encryption
page https://ozone.apache.org/docs/edge/security/securingtde.html with the following instructions:
The Ozone TDE doc is written with the assumption that user is familiar with HDFS TDE, which may not be the case.
We should update the doc such that
(1) It does not require prior knowledge in HDFS TDE.
(2) Ozone can work with Hadoop KMS and Ranger KMS. We should mention Ranger KMS in the doc.
(3) For Ranger KMS, encryption key can also be managed by Ranger KMS management console or its REST API.
(4) hadoop key create enckey command has additional parameters: -size: specifies key bit length. Ozone supports 128 and 256 bits; -cipher: only AES/CTR/NoPadding (default) is supported as of now.
(5) Add reference to Transparent Encryption in HDFS: https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-hdfs/TransparentEncryption.html and Hadoop KMS doc: https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html
(6) For the section Using Transparent Data Encryption from S3G, we should mention Ozone does not support S3-SSE (Server-Side Encryption) or S3-CSE (Client-Side Encryption). That said, Ozone S3 buckets can be encrypted using Ranger/Hadoop KMS to provide the same guarantee as S3-SSE with client-supplied key (S3 SSE-C).
(7) For section KMS Authorization: provide examples.
Be succinct. Insert new text to the existing content, instead of rewriting everything.
```
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-13148
## How was this patch tested?
User doc only update.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl merged PR #8530:
URL: https://github.com/apache/ozone/pull/8530
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2125006958
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
Review Comment:
This is actually a fair suggestion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2127034878
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
- ```bash
- hadoop key create enckey
- ```
- The above command creates an encryption key for the bucket you want to protect.
- Once the key is created, you can tell Ozone to use that key when you are
- reading and writing data into a bucket.
+### Creating an Encryption Key
- * Assign the encryption key to a bucket.
+Use the `hadoop key create` command to create an encryption key in the configured KMS:
- ```bash
- ozone sh bucket create -k enckey /vol/encryptedbucket
- ```
+```shell
+ hadoop key create <key_name> [-size <key_bit_length>] [-cipher <cipher_suite>] [-description <description>]
+```
+
+* `<key_name>`: The name of the encryption key.
+* **`-size <key_bit_length>` (Optional):** Specifies the key bit length. Ozone supports **128** (default) and **256** bits.
+* **`-cipher <cipher_suite>` (Optional):** Specifies the cipher suite. Currently, only **`AES/CTR/NoPadding`** (the default) is supported.
Review Comment:
but in practice, AES standard allows only 128, 192 and 256 bits.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #8530:
URL: https://github.com/apache/ozone/pull/8530#issuecomment-2940605410
Updated per Gemini's suggestion https://github.com/jojochuang/ozone/pull/567
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #8530:
URL: https://github.com/apache/ozone/pull/8530#issuecomment-2961011825
Thanks @smengcl !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #8530:
URL: https://github.com/apache/ozone/pull/8530#issuecomment-2960990531
Thanks @jojochuang for the doc improvement effort!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2126997320
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
- ```bash
- hadoop key create enckey
- ```
- The above command creates an encryption key for the bucket you want to protect.
- Once the key is created, you can tell Ozone to use that key when you are
- reading and writing data into a bucket.
+### Creating an Encryption Key
- * Assign the encryption key to a bucket.
+Use the `hadoop key create` command to create an encryption key in the configured KMS:
- ```bash
- ozone sh bucket create -k enckey /vol/encryptedbucket
- ```
+```shell
+ hadoop key create <key_name> [-size <key_bit_length>] [-cipher <cipher_suite>] [-description <description>]
+```
+
+* `<key_name>`: The name of the encryption key.
+* **`-size <key_bit_length>` (Optional):** Specifies the key bit length. Ozone supports **128** (default) and **256** bits.
+* **`-cipher <cipher_suite>` (Optional):** Specifies the cipher suite. Currently, only **`AES/CTR/NoPadding`** (the default) is supported.
Review Comment:
Well, to be precise it's the KMS server that supports 128 and 256 bits. Though it would be a good idea to add tests to verify Ozone accepts these two values.
https://docs.cloudera.com/cdp-private-cloud-base/7.1.8/security-encrypting-data-at-rest/topics/security-ranger-kms-list-and-create-keys.html
Ranger KMS supports 128 and 256.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2125017781
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
- ```bash
- hadoop key create enckey
- ```
- The above command creates an encryption key for the bucket you want to protect.
- Once the key is created, you can tell Ozone to use that key when you are
- reading and writing data into a bucket.
+### Creating an Encryption Key
- * Assign the encryption key to a bucket.
+Use the `hadoop key create` command to create an encryption key in the configured KMS:
- ```bash
- ozone sh bucket create -k enckey /vol/encryptedbucket
- ```
+```shell
+ hadoop key create <key_name> [-size <key_bit_length>] [-cipher <cipher_suite>] [-description <description>]
+```
+
+* `<key_name>`: The name of the encryption key.
+* **`-size <key_bit_length>` (Optional):** Specifies the key bit length. Ozone supports **128** (default) and **256** bits.
+* **`-cipher <cipher_suite>` (Optional):** Specifies the cipher suite. Currently, only **`AES/CTR/NoPadding`** (the default) is supported.
Review Comment:
Where does it say 256 bits key length is supported?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2127020842
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
- ```bash
- hadoop key create enckey
- ```
- The above command creates an encryption key for the bucket you want to protect.
- Once the key is created, you can tell Ozone to use that key when you are
- reading and writing data into a bucket.
+### Creating an Encryption Key
- * Assign the encryption key to a bucket.
+Use the `hadoop key create` command to create an encryption key in the configured KMS:
- ```bash
- ozone sh bucket create -k enckey /vol/encryptedbucket
- ```
+```shell
+ hadoop key create <key_name> [-size <key_bit_length>] [-cipher <cipher_suite>] [-description <description>]
+```
+
+* `<key_name>`: The name of the encryption key.
+* **`-size <key_bit_length>` (Optional):** Specifies the key bit length. Ozone supports **128** (default) and **256** bits.
+* **`-cipher <cipher_suite>` (Optional):** Specifies the cipher suite. Currently, only **`AES/CTR/NoPadding`** (the default) is supported.
Review Comment:
Hadoop KMS supports any number that is multiple of 8, even just 8 bits: https://github.com/apache/hadoop/blob/f1ee35b8a181581d6cc6bffe0dc5157d6d1047da/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyProviderFactory.java#L157
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2121681191
##########
hadoop-hdds/docs/content/feature/Topology.md:
##########
@@ -105,4 +105,4 @@ Finally the read path also should be configured to read the data from the closes
## References
* Hadoop documentation about `net.topology.node.switch.mapping.impl`: https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/RackAwareness.html
- * [Design doc]({{< ref "design/topology.md">}})
\ No newline at end of file
+ * [Design doc]({{< ref "design/topology.md">}})
Review Comment:
tbh I can't tell what is changed on this line. I don't see a new line being added or sth either.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2127091881
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
Review Comment:
I'd still prefer to leave it as is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2116479038
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
Review Comment:
Consider clarifying the placeholder <kms_provider_path> by using escaped entities (e.g., <kms_provider_path>) to avoid confusion with XML tags.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2125022609
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -112,25 +128,25 @@ However, in buckets with `FILE_SYSTEM_OPTIMIZED` layout, some irregular S3 key
names may be rejected or normalized, which can be undesired.
See [Prefix based File System Optimization]({{< relref "../feature/PrefixFSO.md" >}}) for more information.
-In non-secure mode, the user running the S3Gateway daemon process is the proxy user,
-while in secure mode the S3Gateway Kerberos principal (ozone.s3g.kerberos.principal) is the proxy user.
-S3Gateway proxy's all the users accessing the encrypted buckets to decrypt the key.
-For this purpose on security enabled cluster, during S3Gateway server startup
-logins using configured
-**ozone.s3g.kerberos.keytab.file** and **ozone.s3g.kerberos.principal**.
+When accessing an S3G-enabled encrypted bucket:
+
+* **Secure Mode (Kerberos enabled):**
+ The S3 Gateway proxy user (configured by `ozone.s3g.proxy.user`) must have permissions to decrypt the encryption key. This user also needs proxy user privileges for the end-user (e.g., be configured as a proxy user in `core-site.xml` for Hadoop’s proxy user mechanism).
+* **Non-Secure Mode:**
+ The user running the S3 Gateway (typically the user who started the S3G daemon) must have permissions to decrypt the encryption key.
-The below two configurations must be added to the kms-site.xml to allow the S3Gateway principal to act as a proxy for other users. In this example, "ozone.s3g.kerberos.principal" is assumed to be "s3g"
+The below two configurations must be added to the kms-site.xml to allow the S3Gateway principal to act as a proxy for other users. In this example, "ozone.
+s3g.kerberos.principal" is assumed to be "s3g"
Review Comment:
```suggestion
The below two configurations must be added to `kms-site.xml` to allow the S3Gateway principal to act as a proxy for other users. In this example, `ozone.s3g.kerberos.principal` is assumed to be `s3g`
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2125020590
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
- ```bash
- hadoop key create enckey
- ```
- The above command creates an encryption key for the bucket you want to protect.
- Once the key is created, you can tell Ozone to use that key when you are
- reading and writing data into a bucket.
+### Creating an Encryption Key
- * Assign the encryption key to a bucket.
+Use the `hadoop key create` command to create an encryption key in the configured KMS:
- ```bash
- ozone sh bucket create -k enckey /vol/encryptedbucket
- ```
+```shell
+ hadoop key create <key_name> [-size <key_bit_length>] [-cipher <cipher_suite>] [-description <description>]
+```
+
+* `<key_name>`: The name of the encryption key.
+* **`-size <key_bit_length>` (Optional):** Specifies the key bit length. Ozone supports **128** (default) and **256** bits.
+* **`-cipher <cipher_suite>` (Optional):** Specifies the cipher suite. Currently, only **`AES/CTR/NoPadding`** (the default) is supported.
+* `-description <description>` (Optional): A description for the key.
+
+For example:
+
+```shell
+ hadoop key create enckey -size 256 -cipher AES/CTR/NoPadding -description "Encryption key for my_bucket"
+```
+
+### Creating an Encrypted Bucket
+
+Use the Ozone shell `ozone sh bucket create` command with the `-k` (or `--key`) option to specify the encryption key:
+
+```shell
+ ozone sh bucket create --key <key_name> /<volume_name>/<bucket_name>
+```
+
+For example:
+
+```shell
+ ozone sh bucket create --key enckey /vol1/encrypted_bucket
+```
-After this command, all data written to the _encryptedbucket_ will be encrypted
-via the enckey and while reading the clients will talk to Key Management
-Server and read the key and decrypt it. In other words, the data stored
-inside Ozone is always encrypted. The fact that data is encrypted at rest
-will be completely transparent to the clients and end users.
+Now, all data written to `/vol1/encrypted_bucket` will be encrypted.
Review Comment:
```suggestion
Now, all data written to `/vol1/encrypted_bucket` will be encrypted at rest. As long as the client is configured correctly to use the key, such encryption is completely transperent to the end users.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2125011909
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
- ```bash
- hadoop key create enckey
- ```
- The above command creates an encryption key for the bucket you want to protect.
- Once the key is created, you can tell Ozone to use that key when you are
- reading and writing data into a bucket.
+### Creating an Encryption Key
- * Assign the encryption key to a bucket.
+Use the `hadoop key create` command to create an encryption key in the configured KMS:
- ```bash
- ozone sh bucket create -k enckey /vol/encryptedbucket
- ```
+```shell
+ hadoop key create <key_name> [-size <key_bit_length>] [-cipher <cipher_suite>] [-description <description>]
+```
+
+* `<key_name>`: The name of the encryption key.
+* **`-size <key_bit_length>` (Optional):** Specifies the key bit length. Ozone supports **128** (default) and **256** bits.
+* **`-cipher <cipher_suite>` (Optional):** Specifies the cipher suite. Currently, only **`AES/CTR/NoPadding`** (the default) is supported.
Review Comment:
```suggestion
* `-size <key_bit_length>` (Optional): Specifies the key bit length. Ozone supports 128 (default) and 256 bits.
* `-cipher <cipher_suite>` (Optional): Specifies the cipher suite. Currently, only `AES/CTR/NoPadding` (the default) is supported.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2125009787
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
+ </property>
- * Create a bucket encryption key with hadoop key CLI, which is similar to
- how you would use HDFS encryption zones.
+ Replace `<kms_provider_path>` with the actual URI of your KMS. For example, `kms://http@kms1.example.com:9600/kms`
Review Comment:
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-13148. [Docs] Update Transparent Data Encryption doc. [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #8530:
URL: https://github.com/apache/ozone/pull/8530#discussion_r2125008857
##########
hadoop-hdds/docs/content/security/SecuringTDE.md:
##########
@@ -25,64 +25,80 @@ icon: lock
limitations under the License.
-->
-Ozone TDE setup process and usage are very similar to HDFS TDE.
-The major difference is that Ozone TDE is enabled at Ozone bucket level
-when a bucket is created.
+Ozone Transparent Data Encryption (TDE) enables you to encrypt data at rest. TDE is enabled at the bucket level when a bucket is created. To use TDE, an administrator must first configure a Key Management Server (KMS). Ozone can work with **Hadoop KMS** and **Ranger KMS**. The KMS URI needs to be provided to Ozone via the `core-site.xml` configuration file.
-### Setting up the Key Management Server
+Once the KMS is configured, users can create an encryption key and then create an encrypted bucket using that key. All data written to an encrypted bucket will be transparently encrypted on the server-side, and data read from the bucket will be transparently decrypted.
-To use TDE, admin must setup a Key Management Server and provide that URI to
-Ozone/HDFS. Since Ozone and HDFS can use the same Key Management Server, this
- configuration can be provided via *core-site.xml*.
+### Configuring TDE
-Property| Value
------------------------------------|-----------------------------------------
-hadoop.security.key.provider.path | KMS uri. <br> e.g. kms://http@kms-host:9600/kms
+1. **Set up a Key Management Server (KMS):**
+ * **Hadoop KMS:** Follow the instructions in the [Hadoop KMS documentation](https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html).
+ * **Ranger KMS:** Ranger KMS can also be used. For Ranger KMS, encryption keys can be managed via the Ranger KMS management console or its [REST API](https://ranger.apache.org/kms/apidocs/index.html), in addition to the `hadoop key` command line interface.
-### Using Transparent Data Encryption
-If this is already configured for your cluster, then you can simply proceed
-to create the encryption key and enable encrypted buckets.
+2. **Configure Ozone:**
+ Add the following property to Ozone’s `core-site.xml`:
-To create an encrypted bucket, client need to:
+ <property>
+ <name>hadoop.security.key.provider.path</name>
+ <value><kms_provider_path></value>
Review Comment:
Just use `kms://http@kms-host:9600/kms`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org