New Features in Key Trustee KMS

There is a newly-documented feature that describes how to move a Key Trustee KMS proxy service role instance from an existing cluster host to another cluster host. For details, refer to Migrating a Key Trustee KMS Server Role Instance to a New Host.

There is a new feature that provides logic to detect and warn users about a potential problem where the GPG private keys have not been properly synchronized across all Key Trustee KMS HA hosts. For details, refer to Validating Private Key Synchronization (Key Trustee KMS HA Only), Enabling Key Trustee KMS High Availability, and Key Trustee KMS Encryption Issues.

There is a new procedure for migrating from a Key Trustee KMS (KT KMS) to a Hardware Security Module KMS (HSM KMS). For details, refer to Migrating from a Key Trustee KMS to an HSM KMS.

• Re-encryption of encrypted data encryption keys (EDEKs), which ensures the automated re-encryption of all datafiles, and helps companies avoid the cost in time and resource of copying, decrypting, and re-encrypting datafiles. New, or re-encrypted key versions apply to datafiles previously encrypted by earlier key versions.
• Support for RHEL 7.4
• Support for OEL 7.4

• The Key Trustee Parcel will no longer be released via archive.cloudera.com. The parcel will now be released via www.cloudera.com/downloads. Parcels already released on the archive site will continue to be available there.
• Support for RHEL 6.9
• Support for OEL 6.9

• Support for SLES 12 SP2
• Support for Ubuntu 16.04

• Support for RHEL 7.3
• Support for OEL 7.3

• Support for RHEL 6.8
• Support for OEL 6.8
• Support for Debian 8.4
• Support for SLES 12 SP1

• An issue has been fixed. See Issues Fixed in Key Trustee KMS 5.8.2.

• Support for Debian 8.2
• When adding the parcel-based Key Trustee KMS service for the first time, Cloudera Manager automatically backs up Key Trustee KMS locally. For more information, see 7. Add a Key Trustee KMS Service.
• The Key Trustee KMS backup script (ktbackup.sh) adds a new option, --roll, which specifies the number of backups to retain. For more information, see Backing Up Key Trustee Server and Key Trustee KMS Using the ktbackup.sh Script.
• When Key Trustee Server is configured for high availability, adding the Key Trustee KMS service in Cloudera Manager automatically configures round robin DNS load balancing.

• An issue has been fixed. See Issues Fixed in Key Trustee KMS 5.7.4.

• An issue has been fixed. See Issues Fixed in Key Trustee KMS 5.7.1.

• Support for RHEL 7.2
• Support for OEL 5.11, 7.2
• Support for SLES 11 SP4
• Support for Debian 7.8
• A backup script (ktbackup.sh) is included with Key Trustee KMS. See Backing Up and Restoring Key Trustee Server and Clients for more information.

• A number of issues have been fixed. See Issues Fixed in Key Trustee KMS 5.5.4.

• Rolling restart works with Key Trustee KMS high availability.
• When running Key Trustee KMS in a highly available configuration, Cloudera Manager can automatically generate the load balancer URL.

• A passive Key Trustee Server can be added to the Key Trustee KMS configuration using Cloudera Manager.
• An issue has also been fixed. See Issues Fixed in Key Trustee KMS 5.4.3.