HDFS透明加密

HDFS透明加密

配置集群key.provider.uri

dfs.encryption.key.provider.uri
#The KeyProvider to use when interacting with encryption keys used when reading and writing to an encryption zone.
#当往加密空间读写时需要使用它来做交互。

配置加密算法和编解码

hadoop.security.crypto.codec.classes.EXAMPLECIPHERSUITE
#The prefix for a given crypto codec, contains a comma-separated list of implementation classes for a given crypto codec (eg EXAMPLECIPHERSUITE). The first implementation will be used if available, others are fallbacks.

hadoop.security.crypto.codec.classes.aes.ctr.nopadding
Default: org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec,org.apache.hadoop.crypto.JceAesCtrCryptoCodec

#Comma-separated list of crypto codec implementations for AES/CTR/NoPadding. The first implementation will be used if available, others are fallbacks.

hadoop.security.crypto.cipher.suite
Default: AES/CTR/NoPadding

#Cipher suite for crypto codec.

hadoop.security.crypto.jce.provider
Default: None

#The JCE provider name used in CryptoCodec.

hadoop.security.crypto.buffer.size
Default: 8192

#The buffer size used by CryptoInputStream and CryptoOutputStream.

配置Namenode

dfs.namenode.list.encryption.zones.num.responses
Default: 100

#When listing encryption zones, the maximum number of zones that will be returned in a batch. Fetching the list incrementally in batches improves namenode performance.

官网使用案例

#查询已经创建的加密空间
hdfs crypto -listZones

# As the normal user, create a new encryption key
hadoop key create mykey

# As the super user, create a new empty directory and make it an encryption zone
hadoop fs -mkdir /zone
hdfs crypto -createZone -keyName mykey -path /zone

# chown it to the normal user
hadoop fs -chown myuser:myuser /zone

# As the normal user, put a file in, read it out
hadoop fs -put helloWorld /zone
hadoop fs -cat /zone/helloWorld