Help Center/ MapReduce Service/ User Guide (Ankara Region)/ FusionInsight Manager Operation Guide/ Security Management/ Security Hardening/ Configuring ZooKeeper SSL
Updated on 2024-11-29 GMT+08:00
View PDF
Share

Configuring ZooKeeper SSL

Scenario

By default, SSL channel encryption transmission is disabled between the ZooKeeper client and server and between instances on the server. This section describes how to enable the ZooKeeper channel encryption transmission.

Impact on the System

  • When SSL channel encryption transmission is enabled on the ZooKeeper server, the performance deteriorates.
  • When SSL channel encryption transmission is enabled on the ZooKeeper server, ZooKeeper and dependent upper-layer components need to be restarted. During the restart, services are unavailable.
  • To enable SSL channel encryption transmission on the ZooKeeper server, you need to download the client again.
  • If SSL channel encryption transmission is enabled for ZooKeeper, rolling restart is not supported.
  • Guardian does not support SSL for ZooKeeper.

Procedure

  1. Log in to FusionInsight Manager, click Cluster and choose Services > ZooKeeper. On the displayed page, click Configurations and click All Configurations.
  2. Enter the parameter name in the search box, and change the value as follows:

    Table 1 Security configuration item

    Parameter

    Description

    Default Value

    New Value

    ssl.enabled

    Whether to enable SSL communication encryption.

    false

    true

  3. After the modification is complete, click Save and then click OK.
  4. Click Cluster and choose Services > ZooKeeper. On the ZooKeeper service page, choose More > Restart Service, enter the password for authentication, and confirm the operation impact on the Restart Service page.

    You can select Restart upper-layer services. During the restart of all affected components, services will be unavailable. Exercise caution when performing this operation.

  5. Click OK and wait until the services are restarted successfully.
  6. Choose Cluster > Active/Standby Cluster DR to check whether active/standby DR is configured for the current cluster.

    • If yes, go to 7.
    • If no, no further action is required.

  7. The ssl.enabled configuration of the ZooKeeper service in the active cluster must be the same as that in the DR cluster. Modify the ssl.enabled parameter in the cluster where no operation is performed by referring to the preceding steps.
  8. Log in to the active OMS node in the active cluster as user root and run the following commands to restart the DR management process:

    su - omm

    ${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh

    If the following information is displayed, the operation is successful:

    ...
disaster start with process id : 23256
End into restart-disaster.sh

  9. Log in to the active OMS node in the DR cluster as user root and run the following commands to restart the DR management process:

    su - omm

    ${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh

  10. (Optional) If the cluster uses Flink services, log in to the node where the Flink client is installed as user root and run the following command to modify the Flink configuration file:

    cd Client installation directory/client/Flink/flink/conf

    vim flink-conf.yaml

    Add the following parameters to the end of env.java.opts and save the file:

     -Dzookeeper.clientCnxnSocket=ClientCnxnSocketNetty -Dzookeeper.client.secure=true

  1. (Optional) If the cluster uses the HetuEngine service, log in to Manager, restart HSBroker, and then log in to the HetuEngine web UI to restart all compute instances.
Parent topic: Security Hardening