Help Center/ MapReduce Service/ User Guide/ MRS Cluster O&M/ MRS Cluster Security Configuration/ MRS Cluster Security Hardening/ Configuring ZooKeeper Data Encryption During Transmission
Updated on 2024-09-23 GMT+08:00
View PDF
Share

Configuring ZooKeeper Data Encryption During Transmission

Scenario

By default, SSL channel encryption transmission is disabled between the ZooKeeper client and server and between instances on the server. This section describes how to enable the ZooKeeper channel encryption transmission.

This function is available only for MRS clusters of version 3.1.2 or later.

Impact on the System

  • When SSL channel encryption transmission is enabled on the ZooKeeper server, the performance deteriorates.
  • When SSL channel encryption transmission is enabled on the ZooKeeper server, ZooKeeper and dependent upper-layer components need to be restarted. During the restart, services are unavailable.
  • To enable SSL channel encryption transmission on the ZooKeeper server, you need to download the client again.
  • If SSL channel encryption transmission is enabled for ZooKeeper, rolling restart is not supported.

Configuring ZooKeeper Data Encryption During Transmission

  1. Log in to FusionInsight Manager, click Cluster and choose Services > ZooKeeper. On the displayed page, click Configurations and click All Configurations.
  2. Enter the parameter name in the search box, and change the value as follows:

    Table 1 Security configuration item

    Parameter

    Description

    Default Value

    New Value

    ssl.enabled

    Whether to enable SSL communication encryption.

    false

    true

  3. After the modification is complete, click Save and then click OK.
  4. Click Dashboard. In the upper right corner of the displayed page, choose More > Restart Service, enter the password, and confirm the operation impact.

    You can select Restart upper-layer services. During the restart of all affected components, services will be unavailable. Exercise caution when performing this operation.

  5. Click OK and wait until the services are restarted successfully.
  6. Choose Cluster > Active/Standby Cluster DR to check whether active/standby DR is configured for the current cluster.

    • If yes, go to 7.
    • If no, no further action is required.

  7. The ssl.enabled configuration of the ZooKeeper service in the active cluster must be the same as that in the DR cluster. Modify the ssl.enabled parameter in the cluster where no operation is performed by referring to the preceding steps.
  8. Log in to the active OMS node in the active cluster as user root and run the following commands to restart the DR management process:

    su - omm

    ${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh

    If the following information is displayed, the operation is successful:

    ...
disaster start with process id : 23256
End into restart-disaster.sh

  9. Log in to the active OMS node in the DR cluster as user root and run the following commands to restart the DR management process:

    su - omm

    ${BIGDATA_HOME}/om-server/om/share/om/disaster/sbin/restart-disaster.sh