Configuring ZooKeeper SSL

Updated on 2024-11-29 GMT+08:00

View PDF

Scenario

By default, SSL channel encryption transmission is disabled between the ZooKeeper client and server and between instances on the server. This section describes how to enable the ZooKeeper channel encryption transmission.

Impact on the System

When SSL channel encryption transmission is enabled on the ZooKeeper server, the performance deteriorates.
When SSL channel encryption transmission is enabled on the ZooKeeper server, ZooKeeper and dependent upper-layer components need to be restarted. During the restart, services are unavailable.
To enable SSL channel encryption transmission on the ZooKeeper server, you need to download the client again.
If SSL channel encryption transmission is enabled for ZooKeeper, rolling restart is not supported.
Guardian does not support SSL for ZooKeeper.

Procedure

Log in to FusionInsight Manager, click Cluster and choose Services > ZooKeeper. On the displayed page, click Configurations and click All Configurations.

Enter the parameter name in the search box, and change the value as follows:

**Table 1** Security configuration item
Parameter	Description	Default Value	New Value
ssl.enabled	Whether to enable SSL communication encryption.	false	true

After the modification is complete, click Save and then click OK.
Click Cluster and choose Services > ZooKeeper. On the ZooKeeper service page, choose More > Restart Service, enter the password for authentication, and confirm the operation impact on the Restart Service page.

You can select Restart upper-layer services. During the restart of all affected components, services will be unavailable. Exercise caution when performing this operation.
Click OK and wait until the services are restarted successfully.
Choose Cluster > Active/Standby Cluster DR to check whether active/standby DR is configured for the current cluster.
- If yes, go to 7.
- If no, no further action is required.
The ssl.enabled configuration of the ZooKeeper service in the active cluster must be the same as that in the DR cluster. Modify the ssl.enabled parameter in the cluster where no operation is performed by referring to the preceding steps.
Log in to the active OMS node in the active cluster as user root and run the following commands to restart the DR management process:

su - omm

${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh

If the following information is displayed, the operation is successful:
```
...
disaster start with process id : 23256
End into restart-disaster.sh
```
Log in to the active OMS node in the DR cluster as user root and run the following commands to restart the DR management process:

su - omm

${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh
(Optional) If the cluster uses Flink services, log in to the node where the Flink client is installed as user root and run the following command to modify the Flink configuration file:

cd Client installation directory/client/Flink/flink/conf

vim flink-conf.yaml

Add the following parameters to the end of env.java.opts and save the file:
```
 -Dzookeeper.clientCnxnSocket=ClientCnxnSocketNetty -Dzookeeper.client.secure=true
```

(Optional) If the cluster uses the HetuEngine service, log in to Manager, restart HSBroker, and then log in to the HetuEngine web UI to restart all compute instances.

Parent topic: Security Hardening

Previous topic: Hive Metastore Security Hardening

Next topic: Encrypting the Communication Between the Controller and the Agent