docs/1.0.0/zh/security/securingtde.html - ozone-site - Git at Google



 <!DOCTYPE html>
 <html lang="en">
   <head>
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">

     <meta name="description" content="Hadoop Ozone Documentation">

     <title>Documentation for Apache Hadoop Ozone</title>


     <link href="../../css/bootstrap.min.css" rel="stylesheet">


     <link href="../../css/ozonedoc.css" rel="stylesheet">

   </head>


 <body>


 <nav class="navbar navbar-inverse navbar-fixed-top">
   <div class="container-fluid">
     <div class="navbar-header">
       <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#sidebar" aria-expanded="false" aria-controls="navbar">
         <span class="sr-only">Toggle navigation</span>
         <span class="icon-bar"></span>
         <span class="icon-bar"></span>
         <span class="icon-bar"></span>
       </button>
       <a href="#" class="navbar-left" style="height: 50px; padding: 5px 5px 5px 0;">
         <img src="../../ozone-logo-small.png" width="40"/>
       </a>
       <a class="navbar-brand hidden-xs" href="#">
         Apache Hadoop Ozone/HDDS documentation
       </a>
       <a class="navbar-brand visible-xs-inline" href="#">Hadoop Ozone</a>
     </div>
     <div id="navbar" class="navbar-collapse collapse">
       <ul class="nav navbar-nav navbar-right">
         <li><a href="https://github.com/apache/hadoop-ozone">Source</a></li>
         <li><a href="https://hadoop.apache.org">Apache Hadoop</a></li>
         <li><a href="https://apache.org">ASF</a></li>
       </ul>
     </div>
   </div>
 </nav>


   <div class="container-fluid">
     <div class="row">

 <div class="col-sm-2 col-md-2 sidebar" id="sidebar">
   <ul class="nav nav-sidebar">


             <li class="">

                    <a href="../../zh/">


                     <span>概述</span>
                 </a>
             </li>


             <li class="">

                    <a href="../../zh/start.html">


                     <span>快速入门</span>
                 </a>
             </li>


             <li class="">

                    <a href="../../zh/interface.html">


                     <span>编程接口</span>
                 </a>
             </li>


             <li class="">

                    <a href="../../zh/feature.html">


                     <span>GDPR</span>
                 </a>
             </li>


             <li class="">

                    <a href="../../zh/security.html">


                     <span>安全</span>
                 </a>
             </li>


             <li class="">

                    <a href="../../zh/concept.html">


                     <span>概念</span>
                 </a>
             </li>


             <li class="">

                    <a href="../../zh/tools.html">


                     <span>工具</span>
                 </a>
             </li>


             <li class="">

                    <a href="../../zh/recipe.html">


                     <span>使用配方</span>
                 </a>
             </li>


     <li><a href="../../design.html"><span><b>Design docs</b></span></a></li>
     <li class="visible-xs"><a href="#">References</a>
     <ul class="nav">
         <li><a href="https://github.com/apache/hadoop"><span class="glyphicon glyphicon-new-window" aria-hidden="true"></span> Source</a></li>
         <li><a href="https://hadoop.apache.org"><span class="glyphicon glyphicon-new-window" aria-hidden="true"></span> Apache Hadoop</a></li>
         <li><a href="https://apache.org"><span class="glyphicon glyphicon-new-window" aria-hidden="true"></span> ASF</a></li>
     </ul></li>
   </ul>

 </div>

       <div class="col-sm-10 col-sm-offset-2 col-md-10 col-md-offset-2 main">


         <div class="col-md-9">
             <nav aria-label="breadcrumb">
                 <ol class="breadcrumb">
                   <li class="breadcrumb-item"><a href="../../">Home</a></li>
                   <li class="breadcrumb-item" aria-current="page"><a href="../../zh/security.html">安全</a></li>
                   <li class="breadcrumb-item active" aria-current="page">透明数据加密</li>
                 </ol>
               </nav>


 <div class="pull-right">


     <a href="../../security/securingtde.html"><span class="label label-success">English</span></a>


 </div>


           <div class="col-md-9">
             <h1>透明数据加密</h1>

             <!---
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
 <p>Ozone TDE 的配置和使用和 HDFS TDE 十分相似，主要的区别是，Ozone 中桶级别的 TDE 必须在创建桶时启用。</p>
 <h3 id="配置密钥管理服务器">配置密钥管理服务器</h3>
 <p>使用 TDE 之前，管理员必须要提前配置密钥管理服务 KMS，并且把 KMS 的 URI 通过 core-site.xml 提供给 Ozone。</p>
 <table>
 <thead>
 <tr>
 <th>参数名</th>
 <th>值</th>
 </tr>
 </thead>
 <tbody>
 <tr>
 <td>hadoop.security.key.provider.path</td>
 <td>KMS uri. <br> 比如 kms://http@kms-host:9600/kms</td>
 </tr>
 </tbody>
 </table>
 <h3 id="使用-tde">使用 TDE</h3>
 <p>如果你的集群已经配置好了 TDE，那么你只需要创建加密密钥并启用桶加密即可。</p>
 <p>创建加密密钥的方法为：</p>
 <ul>
 <li>使用 hadoop key 命令创建桶加密密钥，和 HDFS 加密区域的使用方法类似。</li>
 </ul>
 <div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">hadoop key create encKey
 </code></pre></div><p>上面这个命令会创建一个用于保护桶数据的密钥。创建完成之后，你可以告诉 Ozone 在读写某个桶中的数据时使用这个密钥。</p>
 <ul>
 <li>将加密密钥分配给桶</li>
 </ul>
 <div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">ozone sh bucket create -k encKey /vol/encryptedBucket
 </code></pre></div><p>这条命令执行后，所以写往 <em>encryptedBucket</em> 的数据都会用 encKey 进行加密，当读取里面的数据时，客户端通过 KMS 获取密钥进行解密。换句话说，Ozone 中存储的数据一直是加密的，但用户和客户端对此完全无感知。</p>


           <a class="btn  btn-success btn-lg" href="../../zh/security/securings3.html">Next >></a>

           </div>

         </div>
       </div>
     </div>
   </div>


 <script src="../../js/jquery-3.5.1.min.js"></script>
 <script src="../../js/ozonedoc.js"></script>
 <script src="../../js/bootstrap.min.js"></script>


 </body>

 </html>


	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="utf-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<meta name="description" content="Hadoop Ozone Documentation">

	<title>Documentation for Apache Hadoop Ozone</title>


	<link href="../../css/bootstrap.min.css" rel="stylesheet">


	<link href="../../css/ozonedoc.css" rel="stylesheet">

	</head>


	<body>


	<nav class="navbar navbar-inverse navbar-fixed-top">
	<div class="container-fluid">
	<div class="navbar-header">
	<button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#sidebar" aria-expanded="false" aria-controls="navbar">
	<span class="sr-only">Toggle navigation</span>
	<span class="icon-bar"></span>
	<span class="icon-bar"></span>
	<span class="icon-bar"></span>
	</button>
	<a href="#" class="navbar-left" style="height: 50px; padding: 5px 5px 5px 0;">
	<img src="../../ozone-logo-small.png" width="40"/>
	</a>
	<a class="navbar-brand hidden-xs" href="#">
	Apache Hadoop Ozone/HDDS documentation
	</a>
	<a class="navbar-brand visible-xs-inline" href="#">Hadoop Ozone</a>
	</div>
	<div id="navbar" class="navbar-collapse collapse">
	<ul class="nav navbar-nav navbar-right">
	<li><a href="https://github.com/apache/hadoop-ozone">Source</a></li>
	<li><a href="https://hadoop.apache.org">Apache Hadoop</a></li>
	<li><a href="https://apache.org">ASF</a></li>
	</ul>
	</div>
	</div>
	</nav>


	<div class="container-fluid">
	<div class="row">

	<div class="col-sm-2 col-md-2 sidebar" id="sidebar">
	<ul class="nav nav-sidebar">



	<li class="">

	<a href="../../zh/">



	<span>概述</span>
	</a>
	</li>



	<li class="">

	<a href="../../zh/start.html">



	<span>快速入门</span>
	</a>
	</li>



	<li class="">

	<a href="../../zh/interface.html">



	<span>编程接口</span>
	</a>
	</li>



	<li class="">

	<a href="../../zh/feature.html">



	<span>GDPR</span>
	</a>
	</li>



	<li class="">

	<a href="../../zh/security.html">



	<span>安全</span>
	</a>
	</li>



	<li class="">

	<a href="../../zh/concept.html">



	<span>概念</span>
	</a>
	</li>



	<li class="">

	<a href="../../zh/tools.html">



	<span>工具</span>
	</a>
	</li>



	<li class="">

	<a href="../../zh/recipe.html">



	<span>使用配方</span>
	</a>
	</li>


	<li><a href="../../design.html"><span><b>Design docs</b></span></a></li>
	<li class="visible-xs"><a href="#">References</a>
	<ul class="nav">
	<li><a href="https://github.com/apache/hadoop"><span class="glyphicon glyphicon-new-window" aria-hidden="true"></span> Source</a></li>
	<li><a href="https://hadoop.apache.org"><span class="glyphicon glyphicon-new-window" aria-hidden="true"></span> Apache Hadoop</a></li>
	<li><a href="https://apache.org"><span class="glyphicon glyphicon-new-window" aria-hidden="true"></span> ASF</a></li>
	</ul></li>
	</ul>

	</div>

	<div class="col-sm-10 col-sm-offset-2 col-md-10 col-md-offset-2 main">



	<div class="col-md-9">
	<nav aria-label="breadcrumb">
	<ol class="breadcrumb">
	<li class="breadcrumb-item"><a href="../../">Home</a></li>
	<li class="breadcrumb-item" aria-current="page"><a href="../../zh/security.html">安全</a></li>
	<li class="breadcrumb-item active" aria-current="page">透明数据加密</li>
	</ol>
	</nav>



	<div class="pull-right">


	<a href="../../security/securingtde.html"><span class="label label-success">English</span></a>




	</div>


	<div class="col-md-9">
	<h1>透明数据加密</h1>

	<!---
	Licensed to the Apache Software Foundation (ASF) under one or more
	contributor license agreements. See the NOTICE file distributed with
	this work for additional information regarding copyright ownership.
	The ASF licenses this file to You under the Apache License, Version 2.0
	(the "License"); you may not use this file except in compliance with
	the License. You may obtain a copy of the License at

	http://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
	-->
	<p>Ozone TDE 的配置和使用和 HDFS TDE 十分相似，主要的区别是，Ozone 中桶级别的 TDE 必须在创建桶时启用。</p>
	<h3 id="配置密钥管理服务器">配置密钥管理服务器</h3>
	<p>使用 TDE 之前，管理员必须要提前配置密钥管理服务 KMS，并且把 KMS 的 URI 通过 core-site.xml 提供给 Ozone。</p>
	<table>
	<thead>
	<tr>
	<th>参数名</th>
	<th>值</th>
	</tr>
	</thead>
	<tbody>
	<tr>
	<td>hadoop.security.key.provider.path</td>
	<td>KMS uri. <br> 比如 kms://http@kms-host:9600/kms</td>
	</tr>
	</tbody>
	</table>
	<h3 id="使用-tde">使用 TDE</h3>
	<p>如果你的集群已经配置好了 TDE，那么你只需要创建加密密钥并启用桶加密即可。</p>
	<p>创建加密密钥的方法为：</p>
	<ul>
	<li>使用 hadoop key 命令创建桶加密密钥，和 HDFS 加密区域的使用方法类似。</li>
	</ul>
	<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">hadoop key create encKey
	</code></pre></div><p>上面这个命令会创建一个用于保护桶数据的密钥。创建完成之后，你可以告诉 Ozone 在读写某个桶中的数据时使用这个密钥。</p>
	<ul>
	<li>将加密密钥分配给桶</li>
	</ul>
	<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">ozone sh bucket create -k encKey /vol/encryptedBucket
	</code></pre></div><p>这条命令执行后，所以写往 <em>encryptedBucket</em> 的数据都会用 encKey 进行加密，当读取里面的数据时，客户端通过 KMS 获取密钥进行解密。换句话说，Ozone 中存储的数据一直是加密的，但用户和客户端对此完全无感知。</p>



	<a class="btn btn-success btn-lg" href="../../zh/security/securings3.html">Next >></a>

	</div>

	</div>
	</div>
	</div>
	</div>




	<script src="../../js/jquery-3.5.1.min.js"></script>
	<script src="../../js/ozonedoc.js"></script>
	<script src="../../js/bootstrap.min.js"></script>


	</body>

	</html>