[ https://issues.apache.org/jira/browse/HDFS-10899?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15678377#comment-15678377 ]
Xiao Chen commented on HDFS-10899: ---------------------------------- Thanks a lot [~andrew.wang] for the great reviews and also [~dilaver] for offline suggestions! Still wip, but attaching for review. What's changed in wip2: - Split kms related change to a subtask. - Addressed most comments. Except some items left as todo: : command usage, writelock when talking to kms. Also structuring as iterator/visitor part isn't done, but inode based traversal looks better now. TODO items: - cancel / verify commands - better metrics - lock tuning and potential batching communication with kms, based on test results. - some additional tests for correctness (raised by Dilaver): -- rm file while its EZ is being reencrypted -- mv file while its EZ is being reencrypted -- rm & recreate file while its EZ is being reencrypted -- append to file while its EZ is being reencrypted > Add functionality to re-encrypt EDEKs. > -------------------------------------- > > Key: HDFS-10899 > URL: https://issues.apache.org/jira/browse/HDFS-10899 > Project: Hadoop HDFS > Issue Type: New Feature > Components: encryption, kms > Reporter: Xiao Chen > Assignee: Xiao Chen > Attachments: HDFS-10899.wip.2.patch, HDFS-10899.wip.patch, Re-encrypt > edek design doc.pdf > > > Currently when an encryption zone (EZ) key is rotated, it only takes effect > on new EDEKs. We should provide a way to re-encrypt EDEKs after the EZ key > rotation, for improved security. -- This message was sent by Atlassian JIRA (v6.3.4#6332) --------------------------------------------------------------------- To unsubscribe, e-mail: hdfs-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: hdfs-issues-h...@hadoop.apache.org