From 9c0a4d3e71910db58d76f8ad7b597fb7a1f300ed Mon Sep 17 00:00:00 2001 From: Xiao Chen Date: Tue, 24 Jan 2017 21:30:10 -0800 Subject: [PATCH] HADOOP-13990. Document KMS usage of CredentialProvider API. Contributed by John Zhuge. --- .../hadoop-common/src/site/markdown/CredentialProviderAPI.md | 1 + hadoop-common-project/hadoop-kms/src/site/markdown/index.md.vm | 3 +++ 2 files changed, 4 insertions(+) diff --git a/hadoop-common-project/hadoop-common/src/site/markdown/CredentialProviderAPI.md b/hadoop-common-project/hadoop-common/src/site/markdown/CredentialProviderAPI.md index 30dfdd8f5e..5e475ceffa 100644 --- a/hadoop-common-project/hadoop-common/src/site/markdown/CredentialProviderAPI.md +++ b/hadoop-common-project/hadoop-common/src/site/markdown/CredentialProviderAPI.md @@ -100,6 +100,7 @@ In summary, first, provision the credentials into a provider then configure the |SSL Passwords |FileBasedKeyStoresFactory leverages the credential provider API in order to resolve the SSL related passwords.|TODO| |HDFS |DFSUtil leverages Configuration.getPassword method to use the credential provider API and/or fallback to the clear text value stored in ssl-server.xml.|TODO| |YARN |WebAppUtils uptakes the use of the credential provider API through the new method on Configuration called getPassword. This provides an alternative to storing the passwords in clear text within the ssl-server.xml file while maintaining backward compatibility.|TODO| +|KMS |Uses HttpServer2.loadSSLConfiguration that leverages Configuration.getPassword to read SSL related credentials. They may be resolved through Credential Provider and/or from the clear text in the config when allowed.|[KMS](../../hadoop-kms/index.html)| |AWS
S3/S3A |Uses Configuration.getPassword to get the S3 credentials. They may be resolved through the credential provider API or from the config for backward compatibility.|[AWS S3/S3A Usage](../../hadoop-aws/tools/hadoop-aws/index.html)| |Azure
WASB |Uses Configuration.getPassword to get the WASB credentials. They may be resolved through the credential provider API or from the config for backward compatibility.|[Azure WASB Usage](../../hadoop-azure/index.html)| |Azure
ADLS |Uses Configuration.getPassword to get the ADLS credentials. They may be resolved through the credential provider API or from the config for backward compatibility.|[Azure ADLS Usage](../../hadoop-azure-datalake/index.html)| diff --git a/hadoop-common-project/hadoop-kms/src/site/markdown/index.md.vm b/hadoop-common-project/hadoop-kms/src/site/markdown/index.md.vm index 810d5689a1..09284e5e15 100644 --- a/hadoop-common-project/hadoop-kms/src/site/markdown/index.md.vm +++ b/hadoop-common-project/hadoop-kms/src/site/markdown/index.md.vm @@ -302,6 +302,9 @@ Configure `etc/hadoop/ssl-server.xml` with proper values, for example: ``` +The SSL passwords can be secured by a credential provider. See +[Credential Provider API](../../../hadoop-project-dist/hadoop-common/CredentialProviderAPI.html). + You need to create an SSL certificate for the KMS. As the `kms` Unix user, using the Java `keytool` command to create the SSL certificate: $ keytool -genkey -alias jetty -keyalg RSA