Cloudera Docs

Product Compatibility Matrix for Cloudera Navigator Encryption

Cloudera Navigator encryption comprises several components.See below for the individual compatibility matrices for each component.

Cloudera Navigator Key Trustee Server

Learn about the recommended hardware and supported distributions for Navigator Key Trustee Server.

Because of a change in the ports used by Key Trustee Server, Navigator Encrypt versions lower than 3.7 and Ranger KMS versions lower than 5.4 are not supported in Key Trustee Server 5.4 and higher.

Key Trustee Server: Recommended Hardware and Supported Distributions

Recommended Hardware and Supported Distributions

Key Trustee Server must be installed on a dedicated server or virtual machine (VM) that is not used for any other purpose. The backing PostgreSQL database must be installed on the same host as the Key Trustee Server, and must not be shared with any other services. For high availability, the active and passive Key Trustee Servers must not share physical resources.

The recommended minimum hardware specifications are as follows:

  • Processor: 1 GHz 64-bit quad core
  • Memory: 8 GB RAM
  • Storage: 20 GB on moderate- to high-performance disk drives
Table 1. Cloudera Navigator Key Trustee Server Compatibility Matrix
Cloudera Navigator Key Trustee Server Version Supported Operating Systems Lowest Supported Cloudera Manager Version Lowest Supported Cloudera Navigator Key HSM Versions Supported Ranger KMS Versions Supported Cloudera Navigator Encrypt Versions
7.1.9
  • RHEL and CentOS: 8.8, 8.8 with FIPS, 8.6, 8.4, 8.2, 7.9, 7.8, 7.7, 7.6, 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8
  • Oracle Linux: 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8
 7.x 7.x 7.x 7.x
7.x
  • RHEL and CentOS: 8.6*, 8.4**, 8.2**, 7.9, 7.8, 7.7, 7.6, 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8 (* RHEL and CentOS 8.6 is supported only for 7.1.8) (** RHEL and CentOS 8.4 , 8.2 are supported only for versions 7.1.7 and higher.)
  • Oracle Linux: 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8
 7.x 7.x 7.x 7.x

Ranger KMS

Learn about the recommended hardware and supported distributions for Ranger KMS.

Ranger KMS can be installed with either Key Trustee Server or a separate database as the backing keystore.

Ranger KMS: Recommended Hardware and Supported Distributions

Recommended Hardware and Supported Distributions

Ranger KMS with Key Trustee Server must be installed on a separate host than Key Trustee Server.

The recommended minimum hardware specifications are as follows:

  • Processor: 1 GHz 64-bit quad core
  • Memory: 8 GB RAM
  • Storage: 20 GB on moderate- to high-performance disk drives
Table 2. Ranger KMS Compatibility Matrix
Ranger KMS Version Supported Operating Systems Supported Key Trustee Server Versions Lowest Supported Cloudera Manager Version Supported CDH Versions
7.1.9
  • RHEL and CentOS: 9.1, 8.8, 8.8 with FIPS, 8.6, 8.4, 8.2, 7.9, 7.8, 7.6, 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8
  • Oracle Linux:7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8
 7.x 7.x 7.x
7.x
  • RHEL and CentOS: 8.6*, 8.4**, 8.2**, 7.9, 7.8, 7.6, 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8 (* RHEL and CentOS 8.6 is supported only for 7.1.8) (** RHEL and CentOS 8.4 , 8.2 are supported only for versions 7.1.7 and higher.)
  • Oracle Linux: 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8
 7.x 7.x 7.x

Cloudera Navigator Key HSM

Learn about the recommended hardware and supported distributions for Navigator Key HSM.

Cloudera Navigator Key HSM must be installed on the same host as Key Trustee Server. Although Key HSM is compatible across all versions of Key Trustee Server, Cloudera strongly recommends also upgrading Key HSM after you upgrade Key Trustee Server. See Installing Cloudera Navigator Key HSM and Upgrading Cloudera Navigator Key HSM for more information.

Key HSM: Recommended Hardware and Supported Distributions

The following are prerequisites for installing Navigator Key HSM:

  • Oracle Java Runtime Environment (JRE) 8 or higher with Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files:
    • JCE for Java SE 8
    • OpenJDK 11
  • A supported HSM device:
    • Thales (formerly Safenet) Luna
      • v6
        • HSM firmware version: 6.2.1
        • HSM software version: 5.2.3-1
      • v7
        • HSM firmware version: 7.0.3
        • HSM software version: 7.2.0
    • SafeNet KeySecure
      • HSM firmware version: 6.2.1
      • HSM software version: 8.0.1, 8.1.0, 8.7.0
    • Thales nSolo, nConnect
      • HSM firmware version: 11.4.0
      • Client software version: 2.28.9cam136
    • AWS CloudHSM
      • Client software version: 1.1.1
  • Key Trustee Server 3.8 or higher

Root access is required to install Navigator Key HSM.

Table 3. Cloudera Navigator Key HSM Compatibility Matrix
Cloudera Navigator Key HSM Version Supported Operating Systems Lowest Supported Key Trustee Server Version
7.x
  • RHEL and CentOS: 8.6*, 8.4**, 8.2**, 7.9, 7.6, 7.5, 7.4, 7.3, 7.2, 6.10, 6.9, 6.8 (* RHEL and CentOS 8.6 is supported only for 7.1.8) (** RHEL and CentOS 8.4 , 8.2 are supported only for versions 7.1.7 and higher.)
 7.x

Cloudera Navigator Encrypt

Learn about the recommended hardware and supported distributions for Navigator Encrypt.

Supported command-line interpreters:

  • sh (Bourne)
  • bash (Bash)
  • dash (Ubuntu)

Network Requirements

For new Ranger KMS installations, Navigator Encrypt initiates TCP traffic over port 9494 (HTTPS) to Ranger KMS.

For new Navigator Key Trustee Server installations, Navigator Encrypt initiates TCP traffic over port 11371 (HTTPS) to the Key Trustee Server.

For upgrades, Navigator Encrypt initiates TCP traffic over ports 80 (HTTP) and 443 (HTTPS) to the Navigator Key Trustee Server.

Internet Access

You must have an active connection to the Internet to download many package dependencies, unless you have internal repositories or mirrors containing the dependent packages.

Maintenance Window

Data is not accessible during the encryption process. Plan for system downtime during installation and configuration.

Administrative Access

To enforce a high level of security, all Navigator Encrypt commands require administrative (root) access (including installation and configuration). If you do not have administrative privileges on your server, contact your system administrator before proceeding.

Package Dependencies

Navigator Encrypt requires these packages, which are resolved by your distribution package manager during installation:

  • dkms
  • keyutils
  • openssl
  • lsof
  • gcc
  • cryptsetup

These packages may have other dependencies that are also resolved by your package manager. Installation works with gcc, gcc3, and gcc4.

Table 4. Cloudera Navigator Encrypt Compatibility Matrix
Cloudera Navigator Encrypt Version Supported Operating Systems Supported Ranger KMS / Key Trustee Server Versions
7.1.9
  • RHEL and CentOS: 9.1, 8.8, 8.8 with FIPS, 8.6, 8.4, 8.2, 7.9
  • Oracle Linux:7.7, 7.6
  • SLES: 15 SP4
  • Ubuntu: 20.04 LTS (Focal)
 Ranger KMS 7.1.9 is supported. KTS 7.1.x is supported.
7.1.8
  • RHEL and CentOS: 8.6, 8.4, 8.2, 7.9
  • Oracle Linux:7.7, 7.6
  • SLES: 12 SP2, SP3, SP4
  • Ubuntu: 20.04 LTS (Focal), 18.04 (Bionic)
 7.1.x
7.1.0
  • RHEL and CentOS: 7.9, 7.8, 7.7, 7.6
  • Oracle Linux:7.7, 7.6
  • SLES: 12 SP2, SP3, SP4
  • Ubuntu: 16.04 LTS (Xenial), 18 (Bionic)
 7.1.0

HSM Support

The following tables decsribe the HSMs supported for the different CDP/ CDH/ HDP versions.

HSM Support for CDP Private Cloud Base 7.x

Table 5. CDP Private Cloud Base 7.x
Luna v6 Luna v7 SafeNet KeySecure nCipher nSolo/nConnect AWS CloudHSM
Ranger KMS

HSM Software Version: 6.1.0-5

HSM Firmware: 6.23.0

Luna Client: 6.1

 CipherTrust Manager 2.0 ( Supported only for 7.1.8 and 7.1.9)
Key HSM

HSM firmware version: 6.2.1

HSM software version: 5.2.3-1

HSM firmware version: 7.0.3

HSM software version: 7.2.0

HSM firmware version: 6.2.1

HSM software version: 8.0.1, 8.1.0, 8.7.0

HSM firmware version: 11.4.0

Client software version: 2.28.9cam136

CipherTrust Manager 2.0 ( Supported only for 7.1.8 and 7.1.9)

 Client software version: 1.1.1