Enabling TLS for the Flood Daemon

Starting with Cloudera Manager version 7.13.2 SP1 (7.13.2.10000), you can secure communications for the Flood daemon using Transport Layer Security (TLS) and Mutual TLS (mTLS).

Ports used for Flood communications

The Flood daemon uses the following default ports for encrypted mTLS traffic:


Communication Path	Protocol / Authentication	Port	Description
Cloudera Manager Agent ↔ Flood HTTPS Server	mTLS	7190	Handles secure HTTPS communication between the Cloudera Manager Agent and the Flood daemon.
Flood ↔ Flood Peers	mTLS	7191	Handles secure peer-to-peer communication between Flood daemons.

Disabling TLS for the Flood Daemon

Cloudera Manager automatically enables TLS for the Flood daemon when you turn on the ENCRYPT_ALL_PORTS feature flag.

If you need to explicitly disable TLS for the Flood daemon while keeping other cluster ports encrypted, complete the following steps on the Cloudera Manager Server host:

Open the Cloudera Manager Server default configuration file in a text editor:
```
sudo vi /etc/default/cloudera-scm-server
```
Add or update the following environment variable:
```
export FLOODIX_TLS=false
```
Restart the Cloudera Manager Server to apply the changes:
```
sudo systemctl restart cloudera-scm-server
```
important
Setting FLOODIX_TLS=false disables mTLS on both port 7190 (Cloudera Manager Agent ↔ Flood) and port 7191 (Flood ↔ Flood peers).

Configuring the TLS version for Flood communication

The Flood daemon automatically inherits its mTLS protocol version from the Cloudera Manager Agent configuration. The Flood daemon derives its TLS protocol version directly from the Cloudera Manager Agent configuration:

If you configure the Cloudera Manager Agent to use TLS 1.3, all Flood communications (both Cloudera Manager Agent to Flood daemon and Flood peer-to-peer) automatically use TLS 1.3.
If you configure the Cloudera Manager Agent to use TLS 1.2, Flood uses TLS 1.2.

Configuring Cipher Suites for Flood Communication

The active TLS version determines which cipher suites the Flood daemon uses for inbound and outbound connections.

TLS 1.3 Cipher Suites

When using TLS 1.3, the Flood daemon automatically negotiates ciphers from the following list for both inbound and outbound traffic. You cannot manually configure custom cipher suites for TLS 1.3 due to a Go runtime limitation:

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384

TLS 1.2 Cipher Suites

When the Cloudera Manager Agent specifies TLS 1.2 in the Flood configuration file, the Flood daemon supports and uses the following cipher suites:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384