Replication of Encrypted Data
Beginning with CDH 5.3, HDFS supports encryption of data at rest (including data accessed through Hive). This section describes the behavior with respect to encryption during replication, depending on whether or not the source and target are in encryption zones, and the procedure for encrypting data in transit between the source and target clusters.
Encrypting Data in Transit Between Clusters
- Source and target directory are both in an encryption zone - In this case, the data on the target directory is encrypted.
- Source directory is not encrypted, possibly because the source cluster uses a version of CDH earlier than 5.2 (the first version to support encryption zones) but the target directory is in an encryption zone - In this case, the data on the target directory is encrypted.
- Source directory is in an encryption zone and target directory is not - In this case, the data on the target directory is not encrypted.
- Neither the source nor the target directory are in encryption zones - In this case, the data on the target directory is not encrypted.
Even when the source and target directories are both in encryption zones, the data is decrypted as it is read from the source cluster (using the key for the source encryption zone) and encrypted again when it is written to the target cluster (using the key for the target encryption zone). By default, it is passed over the wire as plain text.
- Enable SSL/TLS for HDFS clients on both the source and the target clusters. For instructions, see Configuring SSL for HDFS. You may also need to configure trust between the SSL certificates on the source and target.
- Enable SSL/TLS for the two peer Cloudera Manager Servers as described here: Configuring TLS Encryption Only for Cloudera Manager.
- Cloudera recommends you also enable SSL/TLS communication between the Cloudera Manager Server and Agents. See Configuring TLS Security for Cloudera Manager for instructions.