Alexey Serbin has uploaded this change for review. (
http://gerrit.cloudera.org:8080/24383
Change subject: KUDU-3781: add TLS transport support for HMS client
......................................................................
KUDU-3781: add TLS transport support for HMS client
With this patch, the Thrift client used for communication between
Kudu masters and Hive Metastore can protect its connections with TLS.
A couple of new flags have been introduced:
--hive_metastore_tls_enabled (default value is false)
--hive_metastore_tls_trusted_ca_cert_file (default value is "")
All works as expected when the file pointed to by the
--hive_metastore_tls_trusted_ca_cert_file flag contains the CA
certificate that HMS server's TLS certificate is signed
with. In this case, the Thirft client verifies authenticity of
the server's TLS certificate.
To cover the new functionality:
* a few new unit-style scenarios added into hms_client-test.cc
* most of the existing scenarios in hms_catalog-test.cc are now
parameterized by TLS support enabled/disabled
* most of the existing scenarios in master_hms-itest.cc are now
parameterized by TLS support enabled/disabled
There is one open question which should be addresses in a separate
changelist if a decision is made on the following:
* Should we support self-signed HMS server certificates when leaving
--hive_metastore_tls_trusted_ca_cert_file empty? In such a case
the Thrift client cannot check the server's certificate for
authenticity, and the TLS layer is used only for on-the-wire
encryption.
If yes, then it's necessary to patch the Thrift library the 3rd-party.
Change-Id: I9658323ed9aebdfdf8e6847c9c3129f5c8517c65
---
M src/kudu/hms/hms_catalog-test.cc
M src/kudu/hms/hms_catalog.cc
M src/kudu/hms/hms_catalog.h
M src/kudu/hms/hms_client-test.cc
M src/kudu/hms/mini_hms.cc
M src/kudu/hms/mini_hms.h
M src/kudu/integration-tests/master_hms-itest.cc
M src/kudu/mini-cluster/external_mini_cluster.cc
M src/kudu/mini-cluster/external_mini_cluster.h
M src/kudu/thrift/client.cc
M src/kudu/thrift/client.h
M src/kudu/thrift/sasl_client_transport.cc
12 files changed, 378 insertions(+), 80 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/83/24383/1
--
To view, visit http://gerrit.cloudera.org:8080/24383
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I9658323ed9aebdfdf8e6847c9c3129f5c8517c65
Gerrit-Change-Number: 24383
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <[email protected]>
