[
https://issues.apache.org/jira/browse/HADOOP-12951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15209017#comment-15209017
]
Andrew Wang commented on HADOOP-12951:
--------------------------------------
The delegation token discussion is pretty important to understand KMS HA, so
let's talk about that a little. A delegation token is essentially a
time-bounded authentication mechanism, which is cryptographically signed and
verified via a shared secret. In the case of KMS HA, we have multiple KMS
instances, all of which need to be able to verify delegation tokens given out
by another KMS. This means the shared secret needs to be shared, which is done
this by retrieving the shared secret from ZooKeeper. So, if you configure KMS
HA, and you have security turned on (which you should), you need to use
ZooKeeper secret storage. I think this is what the "TBD" section was meant to
cover.
Hopefully that's enough to get started. I think I can dig up more references on
delegation tokens and KMS HA if that will help, DTs in particular should
already be covered in some part of the Hadoop docs.
Otherwise looks good!
> Improve documentation on KMS ACLs and delegation tokens
> -------------------------------------------------------
>
> Key: HADOOP-12951
> URL: https://issues.apache.org/jira/browse/HADOOP-12951
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: Xiao Chen
> Assignee: Xiao Chen
> Attachments: HADOOP-12951.01.patch
>
>
> [~andrew.wang] suggested that the current KMS ACL page is not very
> user-focused, and hard to come by without reading the code.
> I read the document (and the code), and I agree. So this jira puts more
> documentation to explain the current implementation.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
