Configuring ZooKeeper SSL

Scenario

By default, SSL channel encryption transmission is disabled between the ZooKeeper client and server and between instances on the server. This section describes how to enable the ZooKeeper channel encryption transmission.

This function is available only for MRS clusters of version 3.1.2 or later.

Impact on the System

• When SSL channel encryption transmission is enabled on the ZooKeeper server, the performance deteriorates.
• When SSL channel encryption transmission is enabled on the ZooKeeper server, ZooKeeper and dependent upper-layer components need to be restarted. During the restart, services are unavailable.
• To enable SSL channel encryption transmission on the ZooKeeper server, you need to download the client again.
• If SSL channel encryption transmission is enabled for ZooKeeper, rolling restart is not supported.

Procedure

1. Log in to FusionInsight Manager, click Cluster and choose Services > ZooKeeper. On the displayed page, click Configurations and click All Configurations.
2. Enter the parameter name in the search box, and change the value as follows:

   Table 1 Security configuration item

   Parameter	Description	Default Value	New Value
   ssl.enabled	Whether to enable SSL communication encryption.	false	true

3. After the modification is complete, click Save and then click OK.
4. Click Cluster and choose Services > ZooKeeper. On the ZooKeeper service page, choose More > Restart Service, enter the password for authentication, and confirm the operation impact on the Restart Service page.

   You can select Restart upper-layer services. During the restart of all affected components, services will be unavailable. Exercise caution when performing this operation.

5. Click OK and wait until the services are restarted successfully.
6. Choose Cluster > Active/Standby Cluster DR to check whether active/standby DR is configured for the current cluster.
   • If yes, go to 7.
   • If no, no further action is required.

7. The ssl.enabled configuration of the ZooKeeper service in the active cluster must be the same as that in the DR cluster. Modify the ssl.enabled parameter in the cluster where no operation is performed by referring to the preceding steps.
8. Log in to the active OMS node in the active cluster as user root and run the following commands to restart the DR management process:

   su - omm

   ${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh

   If the following information is displayed, the operation is successful:

   ...
   disaster start with process id : 23256
   End into restart-disaster.sh

9. Log in to the active OMS node in the DR cluster as user root and run the following commands to restart the DR management process:

   su - omm

   ${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh