[
https://issues.apache.org/jira/browse/HDFS-10899?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15678377#comment-15678377
]
Xiao Chen commented on HDFS-10899:
----------------------------------
Thanks a lot [~andrew.wang] for the great reviews and also [~dilaver] for
offline suggestions! Still wip, but attaching for review.
What's changed in wip2:
- Split kms related change to a subtask.
- Addressed most comments. Except some items left as todo: : command usage,
writelock when talking to kms. Also structuring as iterator/visitor part isn't
done, but inode based traversal looks better now.
TODO items:
- cancel / verify commands
- better metrics
- lock tuning and potential batching communication with kms, based on test
results.
- some additional tests for correctness (raised by Dilaver):
-- rm file while its EZ is being reencrypted
-- mv file while its EZ is being reencrypted
-- rm & recreate file while its EZ is being reencrypted
-- append to file while its EZ is being reencrypted
> Add functionality to re-encrypt EDEKs.
> --------------------------------------
>
> Key: HDFS-10899
> URL: https://issues.apache.org/jira/browse/HDFS-10899
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: encryption, kms
> Reporter: Xiao Chen
> Assignee: Xiao Chen
> Attachments: HDFS-10899.wip.2.patch, HDFS-10899.wip.patch, Re-encrypt
> edek design doc.pdf
>
>
> Currently when an encryption zone (EZ) key is rotated, it only takes effect
> on new EDEKs. We should provide a way to re-encrypt EDEKs after the EZ key
> rotation, for improved security.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
