Review the list of Ranger KMS issues that are resolved in Cloudera Runtime 7.3.2, its service packs and cumulative hotfixes.
Cloudera Runtime 7.3.2.100 CHF 1
- CDPD-100545: Ranger KMS now checks for master key existence on
GCP before attempting to create one
- 7.3.2.100
- Previously, when Ranger KMS was configured with a GCP HSM
backend, restarting the Ranger KMS service after revoking the
cloudkms.cryptoKeys.create permission would fail with a
PERMISSION_DENIED error. This occurred because Ranger KMS attempted
to create the master key on every service restart, regardless of whether the key
already existed in GCP. Since the create permission is typically
revoked after the initial one-time master key creation, subsequent restarts would
fail.
- This issue is now fixed. Ranger KMS correctly checks for the existence of the master
key in GCP before attempting to create a new one, allowing service restarts to succeed
even after the
create permission has been revoked.
Cloudera Runtime 7.3.2
The fixed issues for Ranger KMS in Cloudera Runtime 7.3.2 include all
cumulative fixes from lower versions, specifically ranging from Cloudera Runtime 7.3.1.100 through 7.3.1.706. For a comprehensive record of
all fixes, see Fixed Issues.
- CDPD-74162: Missing HSTS Headers for 404 Not found requests port
9494
- 7.3.2
- Fixed an issue where Ranger KMS HTTPS endpoints on port 9494 did
not return HTTP Strict-Transport-Security (HSTS) headers for 404 Not Found responses.
Ranger KMS now consistently includes HSTS headers on 404 responses, improving security
for clients accessing the KMS service.
- CDPD-80814: Failed to migrate the Ranger Kms master key if the
masterkey is stored with HDP format
- 7.3.2
- Fixed an issue where migrating the Ranger KMS master key from an
HDP-formatted master key to HSM failed with a NullPointerException, preventing import of
the master key from the Ranger database. The migration utility now correctly handles the
older HDP master key format and completes the migration successfully.
- OPSAPS-72766: Ranger KMS tomcat context update
- 7.3.2
- Updated the default Tomcat context for Ranger KMS from
/kms to / by changing the
ranger.contextName property in ranger-kms-site.xml.
This aligns the Ranger KMS context path with Cloudera
configuration and simplifies access and integration.
