[ https://issues.apache.org/jira/browse/HDFS-11210?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15857085#comment-15857085 ]
Andrew Wang commented on HDFS-11210: ------------------------------------ Gotcha, I figured it was related to negative numbers, though my quick tests with python returned positive numbers. I guess Java's behavior is different; definitely a quirky area for languages. Anyway I'm +1 pending Jenkins (and the comment improvement if you want). Great work here! > Enhance key rolling to guarantee new KeyVersion is returned from > generateEncryptedKeys after a key is rolled > ------------------------------------------------------------------------------------------------------------ > > Key: HDFS-11210 > URL: https://issues.apache.org/jira/browse/HDFS-11210 > Project: Hadoop HDFS > Issue Type: Improvement > Components: encryption, kms > Affects Versions: 2.6.5 > Reporter: Xiao Chen > Assignee: Xiao Chen > Attachments: HDFS-11210.01.patch, HDFS-11210.02.patch, > HDFS-11210.03.patch, HDFS-11210.04.patch, HDFS-11210.05.patch > > > To support re-encrypting EDEK, we need to make sure after a key is rolled, no > old version EDEKs are used anymore. This includes various caches when > generating EDEK. > This is not true currently, simply because no such requirements / necessities > before. > This includes > - Client Provider(s), and corresponding cache(s). > When LoadBalancingKMSCP is used, we need to clear all KMSCPs. > - KMS server instance(s), and corresponding cache(s) > When KMS HA is configured with multiple KMS instances, only 1 will receive > the {{rollNewVersion}} request, we need to make sure other instances are > rolled too. > - The Client instance inside NN(s), and corresponding cache(s) > When {{hadoop key roll}} is succeeded, the client provider inside NN should > be drained too. -- This message was sent by Atlassian JIRA (v6.3.15#6346) --------------------------------------------------------------------- To unsubscribe, e-mail: hdfs-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: hdfs-issues-h...@hadoop.apache.org