Configuring CDP Services for HDFS Encryption

There are recommendations that you must consider for setting up HDFS Transparent Encryption with various CDP services.

important

Encrypting /tmp using HDFS encryption is not supported.

note

Ranger audit directories in HDFS are owned by specific service users. In case of HDFS, it will be the HDFS service user. Typically, HDFS service user is blacklisted for DECRYPT_EEK operation. Hence, enabling encryption of ranger audit directories in HDFS is not recommended.

Transparent Encryption Recommendations for HBase
Make /hbase an encryption zone. Do not create encryption zones as subdirectories under /hbase, because HBase may need to rename files across those subdirectories. When you create the encryption zone, name the key hbase-key to take advantage of auto-generated KMS ACLs.
Transparent Encryption Recommendations for Hive
HDFS encryption has been designed so that files cannot be moved from one encryption zone to another or from encryption zones to unencrypted directories. Therefore, the landing zone for data when using the LOAD DATA INPATH command must always be inside the destination encryption zone.
Transparent Encryption Recommendations for Hue
Make /user/hue an encryption zone because Oozie workflows and other Hue-specific data are stored there by default. When you create the encryption zone, name the key hue-key to take advantage of auto-generated KMS ACLs.
Transparent Encryption Recommendations for Impala
There are various recommendations to consider when configuring HDFS Transparent Encryption for Impala.
Transparent Encryption Recommendations for MapReduce and YARN
MapReduce v1 stores both history and logs on local disks by default. Even if you do configure history to be stored on HDFS, the files are not renamed. Hence, no special configuration is required.
Transparent Encryption Recommendations for Search
Make /solr an encryption zone. When you create the encryption zone, name the key solr-key to take advantage of auto-generated KMS ACLs.
Transparent Encryption Recommendations for Spark
There are various recommendations to consider when configuring HDFS Transparent Encryption for Spark.
Transparent Encryption Recommendations for Sqoop
There are various recommendations to consider when configuring HDFS Transparent Encryption for Sqoop.

Parent topic: HDFS Transparent Encryption