Alexey Serbin has uploaded this change for review. (
http://gerrit.cloudera.org:8080/24379
Change subject: WIP KUDU-3781: add TLS transport support for HMS client
......................................................................
WIP KUDU-3781: add TLS transport support for HMS client
With this patch, the Thrift client used for communication between
Kudu masters and Hive Metastore can protect its connections with TLS.
A couple of new flags have been introduced:
--hive_metastore_tls_enabled (default value is false)
--hive_metastore_tls_trusted_ca_cert_file (default value is "")
With this patch, all scenarios in hms_client-test.cc pass when
placing pre-generated server-keystore.p12 and ca-cert.pem into /tmp
(placing pre-generated keystore and CA cert files shouldn't be necessary
once re-basing on top of [1]).
WIP:
* Collect initial feedback
* Should we support self-signed HMS server certificates when leaving
--hive_metastore_tls_trusted_ca_cert_file empty? If yes, then
I need to add an extra patch for the 3rd-party thrift library.
* Re-base on top of [1] and update the code accordingly
* Brush up the description
* Address a few TODOs in the code
* Add more test scenarios into hms_catalog-test.cc
* Add more test scenarios into hms_client-test.cc
[1] https://gerrit.cloudera.org/#/c/24374/ and update
Change-Id: Icce1706b1b2d59fa20c01766080b04e2c6ca1c7a
---
M src/kudu/hms/hms_catalog.cc
M src/kudu/hms/hms_catalog.h
M src/kudu/hms/hms_client-test.cc
M src/kudu/hms/mini_hms.cc
M src/kudu/hms/mini_hms.h
M src/kudu/thrift/client.cc
M src/kudu/thrift/client.h
M src/kudu/thrift/sasl_client_transport.cc
8 files changed, 277 insertions(+), 84 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/79/24379/1
--
To view, visit http://gerrit.cloudera.org:8080/24379
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Icce1706b1b2d59fa20c01766080b04e2c6ca1c7a
Gerrit-Change-Number: 24379
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <[email protected]>
