Hello Adar Dembo, Todd Lipcon, Alexey Serbin,
I'd like you to do a code review. Please visit
http://gerrit.cloudera.org:8080/6052
to review the following change.
Change subject: [security] security-flags
......................................................................
[security] security-flags
This commit introduces, removes, and renames security flags in an effort
to make the flags more consistent, more understandable, and easier to
use from the command line. Affected flags:
--rpc_authentication
This is a new flag which will apply to Kudu servers and the kudu
command line tool which will allow operators to configure a policy
for authentication of RPC connections. The possible values are
'enabled', 'disabled', and 'required'. Three states are necessary
(as opposed to just 'disabled' and 'required') in order to provide a
graceful upgrade path for clusters from unsecured to secured.
'enabled' is the default. A follow up commit will hook this flag
into the RPC system to ensure that authentication is enforced as
necessary.
--rpc_encryption
This is a new flag which will apply to Kudu servers and the 'kudu'
command line tool which allows operators to configure a policy for
encryption on RPC connections. This is a tristate flag for the same
reasons as outlined in --rpc_authentication. A follow up commit will
hook this flag into the RPC system to ensure that encryption is
enforced as necessary.
--server_require_kerberos
This flag has been removed, and in it's place the --keytab and
--rpc_authentication=required flags are provided. --keytab is used
to enable Kerberos authentication on a server, and
--rpc_authentication=required is used to ensure that all RPCs use
authentication.
--rpc_cert
--rpc_ssl_server_certificate
--rpc_cert is replacing --rpc_ssl_server_certificate. The latter has
a few issues. 1) It's not strictly a server flag, it also applies to
the kudu CLI tool. 2) It's really long, and the length doesn't add
useful description or specificity. 3) The short form (cert instead
of certificate) is common in database CLI configs [1], [2], [3].
--rpc_key
--rpc_ssl_private_key
--rpc_key is replacing --rpc_ssl_private_key. Same reasons as
--rpc_cert.
--rpc_ca_cert
--rpc_ssl_certificate_authority
--rpc_key is replacing --rpc_ssl_private_key. Same reasons as
--rpc_cert.
--webserver_cert
--webserver_certificate_file
--webserver_cert is replacing --webserver_certificate file to stay
consistent with the analogous RPC flag.
--webserver_key
--webserver_private_key_file
--webserver_key is replacing --webserver_private_key_file to stay
consistent with the analogous RPC flag.
--webserver_key_password_cmd
--webserver_private_key_password_cmd
--webserver_key_password_cmd is replacing
--webserver_private_key_password_cmd to stay consistent with
--webserver_key.
[1] https://rethinkdb.com/docs/security/#using-tls
[2] https://www.cockroachlabs.com/docs/create-security-certificates.html#flags
[3] https://docs.mongodb.com/manual/tutorial/configure-ssl/
I looked at Postgres and MySQL as well, but both of those look in the
data directory for the cert and key files, so they don't have individual
CLI arguments. However, they both commonly refer to certificates as
certs in the documentation.
Change-Id: Iaa53348b8969e83d9f794e1e0553bdec12252d9a
---
M java/kudu-client/src/test/java/org/apache/kudu/client/MiniKuduCluster.java
M src/kudu/integration-tests/external_mini_cluster.cc
M src/kudu/rpc/messenger.cc
M src/kudu/rpc/messenger.h
M src/kudu/rpc/negotiation.cc
M src/kudu/rpc/rpc-test-base.h
M src/kudu/rpc/sasl_common.cc
M src/kudu/server/webserver_options.cc
8 files changed, 118 insertions(+), 62 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/52/6052/1
--
To view, visit http://gerrit.cloudera.org:8080/6052
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Iaa53348b8969e83d9f794e1e0553bdec12252d9a
Gerrit-PatchSet: 1
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <[email protected]>
Gerrit-Reviewer: Adar Dembo <[email protected]>
Gerrit-Reviewer: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Todd Lipcon <[email protected]>
