Hello Marton Greber, Zoltan Chovan, Attila Bukor, Kudu Jenkins, Abhishek
Chennaka,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/24383
to look at the new patch set (#3).
Change subject: KUDU-3781: add TLS transport support for HMS client
......................................................................
KUDU-3781: add TLS transport support for HMS client
With this patch, the Thrift client used for communication between
Kudu masters and Hive Metastore can protect its connections with TLS.
A couple of new flags have been introduced:
--hive_metastore_tls_enabled (default value is false)
--hive_metastore_tls_trusted_ca_cert_file (default value is "")
All works as expected when the file pointed to by the
--hive_metastore_tls_trusted_ca_cert_file flag contains the CA
certificate that HMS server's TLS certificate is signed
with. In this case, the Thirft client verifies authenticity of
the server's TLS certificate.
To cover the new functionality:
* a few new scenarios are now present in hms_client-test.cc and
a few are parameterized with TLS support enabled/disabled
* most of scenarios in hms_catalog-test.cc
are now parameterized with TLS support enabled/disabled
* most of scenarios in master_hms-itest.cc
are now parameterized with TLS support enabled/disabled
There is one open question which should be addresses in a separate
changelist if a decision is made on the following:
* Should we support self-signed HMS server certificates when leaving
the --hive_metastore_tls_trusted_ca_cert_file setting empty?
In such a case the Thrift client cannot check HMS server's TLS
certificate for authenticity unless it's signed by one of the
system-wide trusted CAs, and the TLS layer is used only for
on-the-wire encryption.
If yes, then it's necessary to patch the Thrift library the 3rd-party.
Change-Id: I9658323ed9aebdfdf8e6847c9c3129f5c8517c65
---
M src/kudu/hms/CMakeLists.txt
M src/kudu/hms/hms_catalog-test.cc
M src/kudu/hms/hms_catalog.cc
M src/kudu/hms/hms_catalog.h
M src/kudu/hms/hms_client-test.cc
M src/kudu/hms/hms_client.cc
M src/kudu/hms/hms_client.h
M src/kudu/hms/mini_hms.cc
M src/kudu/hms/mini_hms.h
M src/kudu/integration-tests/CMakeLists.txt
M src/kudu/integration-tests/hms_itest-base.h
M src/kudu/integration-tests/master-stress-test.cc
M src/kudu/integration-tests/master_hms-itest.cc
M src/kudu/mini-cluster/external_mini_cluster-test.cc
M src/kudu/mini-cluster/external_mini_cluster.cc
M src/kudu/mini-cluster/external_mini_cluster.h
M src/kudu/thrift/client.cc
M src/kudu/thrift/client.h
M src/kudu/thrift/sasl_client_transport.cc
M src/kudu/tools/kudu-tool-test.cc
20 files changed, 735 insertions(+), 209 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/83/24383/3
--
To view, visit http://gerrit.cloudera.org:8080/24383
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I9658323ed9aebdfdf8e6847c9c3129f5c8517c65
Gerrit-Change-Number: 24383
Gerrit-PatchSet: 3
Gerrit-Owner: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Abhishek Chennaka <[email protected]>
Gerrit-Reviewer: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Attila Bukor <[email protected]>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <[email protected]>
Gerrit-Reviewer: Zoltan Chovan <[email protected]>
