big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HADOOP-14880. [KMS] Document&test missing KMS client side configs. Contributed by Gabor Bota.

Browse Source
This commit is contained in:
Wei-Chiu Chuang 2017-10-19 06:02:13 -07:00
parent 60bfee270e
commit 97c70c7ac6
4 changed files with 22 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
View File

@ -121,10 +121,6 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
private static final String CONFIG_PREFIX = "hadoop.security.kms.client."; private static final String CONFIG_PREFIX = "hadoop.security.kms.client.";
/* It's possible to specify a timeout, in seconds, in the config file */
public static final String TIMEOUT_ATTR = CONFIG_PREFIX + "timeout";
public static final int DEFAULT_TIMEOUT = 60;
/* Number of times to retry authentication in the event of auth failure /* Number of times to retry authentication in the event of auth failure
* (normally happens due to stale authToken) * (normally happens due to stale authToken)
*/ */
@ -361,7 +357,9 @@ public KMSClientProvider(URI uri, Configuration conf) throws IOException {
throw new IOException(ex); throw new IOException(ex);
} }
} }
int timeout = conf.getInt(TIMEOUT_ATTR, DEFAULT_TIMEOUT); int timeout = conf.getInt(
CommonConfigurationKeysPublic.KMS_CLIENT_TIMEOUT_SECONDS,
CommonConfigurationKeysPublic.KMS_CLIENT_TIMEOUT_DEFAULT);
authRetry = conf.getInt(AUTH_RETRY, DEFAULT_AUTH_RETRY); authRetry = conf.getInt(AUTH_RETRY, DEFAULT_AUTH_RETRY);
configurator = new TimeoutConnConfigurator(timeout, sslFactory); configurator = new TimeoutConnConfigurator(timeout, sslFactory);
encKeyVersionQueue = encKeyVersionQueue =

9
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java
View File

@ -721,6 +721,15 @@ public class CommonConfigurationKeysPublic {
/** Default value for KMS_CLIENT_ENC_KEY_CACHE_EXPIRY (12 hrs)*/ /** Default value for KMS_CLIENT_ENC_KEY_CACHE_EXPIRY (12 hrs)*/
public static final int KMS_CLIENT_ENC_KEY_CACHE_EXPIRY_DEFAULT = 43200000; public static final int KMS_CLIENT_ENC_KEY_CACHE_EXPIRY_DEFAULT = 43200000;
/**
* @see
* <a href="{@docRoot}/../hadoop-project-dist/hadoop-common/core-default.xml">
* core-default.xml</a>
*/
public static final String KMS_CLIENT_TIMEOUT_SECONDS =
"hadoop.security.kms.client.timeout";
public static final int KMS_CLIENT_TIMEOUT_DEFAULT = 60;
/** /**
* @see * @see
* <a href="{@docRoot}/../hadoop-project-dist/hadoop-common/core-default.xml"> * <a href="{@docRoot}/../hadoop-project-dist/hadoop-common/core-default.xml">

8
hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
View File

@ -2340,6 +2340,14 @@
key will be dropped. Default = 12hrs key will be dropped. Default = 12hrs
</description> </description>
</property> </property>
<property>
<name>hadoop.security.kms.client.timeout</name>
<value>60</value>
<description>
Sets value for KMS client connection timeout, and the read timeout
to KMS servers.
</description>
</property>
<property> <property>
<name>hadoop.security.kms.client.failover.sleep.base.millis</name> <name>hadoop.security.kms.client.failover.sleep.base.millis</name>

3
hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
View File

@ -33,6 +33,7 @@
import org.apache.hadoop.crypto.key.kms.KMSDelegationToken; import org.apache.hadoop.crypto.key.kms.KMSDelegationToken;
import org.apache.hadoop.crypto.key.kms.LoadBalancingKMSClientProvider; import org.apache.hadoop.crypto.key.kms.LoadBalancingKMSClientProvider;
import org.apache.hadoop.crypto.key.kms.ValueQueue; import org.apache.hadoop.crypto.key.kms.ValueQueue;
import org.apache.hadoop.fs.CommonConfigurationKeysPublic;
import org.apache.hadoop.fs.Path; import org.apache.hadoop.fs.Path;
import org.apache.hadoop.minikdc.MiniKdc; import org.apache.hadoop.minikdc.MiniKdc;
import org.apache.hadoop.security.Credentials; import org.apache.hadoop.security.Credentials;
@ -1883,7 +1884,7 @@ public Void run() throws Exception {
public void testKMSTimeout() throws Exception { public void testKMSTimeout() throws Exception {
File confDir = getTestDir(); File confDir = getTestDir();
Configuration conf = createBaseKMSConf(confDir); Configuration conf = createBaseKMSConf(confDir);
conf.setInt(KMSClientProvider.TIMEOUT_ATTR, 1); conf.setInt(CommonConfigurationKeysPublic.KMS_CLIENT_TIMEOUT_SECONDS, 1);
writeConf(confDir, conf); writeConf(confDir, conf);
ServerSocket sock; ServerSocket sock;