Cloudera Docs

Migrate the Ranger KMS KTS role instance to a new host

After migrating the Ranger Admin, Ramger KMS db role instances to a new host, migrate the Ranger KMS KTS role instance.

Only if Ranger KMS is backed by Key Trustee Server for key storage, should you migrate the Ranger KMS KTS role instance.

  1. Add a new Ranger KMS KTS role instance on another node.
  2. Start the new Ranger KMS KTS role instance.
  3. Stop the initial Ranger KTS service.
  4. Delete the older Ranger KTS instance.
  5. Restart the cluster.
  6. Login to Ranger Admin UI using keyadmin credentials.
  7. Update the cm_kms service to use the kms url that refers to the new hostname.
  8. Copy or rsync conf and gpg files such as keytrustee.conf, pubring.gpp and secring.gpg present at /var/lib/kms-keytrustee/keytrustee/.keytrustee/ from older host to new host. For example: 
    [root@mm-ktslog-1 ~]# ll /var/lib/kms-keytrustee/keytrustee/.keytrustee/
total 20
-rw------- 1 kms kms  715 Oct  7 10:59 keytrustee.conf
-rw------- 1 kms kms 5026 Oct  7 10:59 pubring.gpg
-rw------- 1 kms kms 4885 Oct  7 10:59 secring.gpg
  9. Restart the Ranger KMS KTS service.