Cloudera Docs

Configuring Key Trustee Server High Availability Using Cloudera Manager

  1. Pick one:
    1. For new installations, use the Set up HDFS Data At Rest Encryption wizard and follow the instructions in Enabling HDFS Encryption Using the Wizard. When prompted, make sure that the Enable High Availability option is selected.
    2. If you already have a Key Trustee Server service, and want to enable high availability, see Adding a Role Instance for the Key Trustee Server service instead to add the Passive Key Trustee Server and Passive Database roles.
    After completing the Add Role Instances wizard, the Passive Key Trustee Server and Passive Database roles fail to start. Complete the following manual actions to start these roles:
  2. Stop the Key Trustee Server service (Key Trustee Server service > Actions > Stop).
  3. Run the Set Up Key Trustee Server Database command (Key Trustee Server service > Actions > Set Up Key Trustee Server Database).
  4. Run the following command on the Active Key Trustee Server: 
    sudo rsync -zcav --exclude .ssl /var/lib/keytrustee/.keytrustee root@keytrustee02.example.com:/var/lib/keytrustee/.

    Replace keytrustee02.example.com with the hostname of the Passive Key Trustee Server.

  5. Run the following command on the Passive Key Trustee Server: 
    sudo ktadmin init
  6. Start the Key Trustee Server service (Key Trustee Server service > Actions > Start).
  7. Enable synchronous replication (Key Trustee Server service > Actions > Setup Enable Synchronous Replication in HA mode).
  8. Restart the Key Trustee Server service (Key Trustee Server service > Actions > Restart).