[
https://issues.apache.org/jira/browse/HADOOP-19665?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
AMC-team updated HADOOP-19665:
------------------------------
Attachment: (was: kms_expiry_from_token_lifetime.patch)
> [kms] Negative hadoop.security.kms.client.encrypted.key.cache.expiry causes
> KMSClientProvider init failure with generic IllegalArgumentException; improve
> validation message and docs
> -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: HADOOP-19665
> URL: https://issues.apache.org/jira/browse/HADOOP-19665
> Project: Hadoop Common
> Issue Type: Bug
> Components: kms
> Affects Versions: 2.8.5
> Reporter: AMC-team
> Priority: Major
> Attachments: HADOOP-19665.000.patch
>
>
> When the client-side config
> hadoop.security.kms.client.encrypted.key.cache.expiry is set to a negative
> value in core-site.xml, any tool that initializes KMSClientProvider (e.g.,
> KeyShell) fails immediately with:
> {code:java}
> java.lang.IllegalArgumentException: expiry must be > 0
> at org.apache.hadoop.crypto.key.kms.ValueQueue.<init>(ValueQueue.java:xxx)
> at
> org.apache.hadoop.crypto.key.kms.KMSClientProvider.<init>(KMSClientProvider.java:xxx)
> ...
> {code}
> This is a controlled failure (JVM doesn’t crash), but the error message does
> not mention which property and what value triggered it. Users typically see a
> stack trace without a clear remediation hint.
> *Expected behavior*
> Fail fast with a clear configuration error that names the property and value,
> e.g.:
> Invalid configuration: hadoop.security.kms.client.encrypted.key.cache.expiry
> = -1 (must be > 0 ms)
> *Steps to Reproduce*
> 1. In the client core-site.xml, set:
> {code:xml}
> <property>
> <name>hadoop.security.kms.client.encrypted.key.cache.expiry</name>
> <value>-1</value>
> </property>
> {code}
> 2. Ensure the conf is active (echo $HADOOP_CONF_DIR points to this dir).
> 3. Run:
> {code:java}
> ./bin/hadoop key list -provider kms://http@localhost:9600/kms -metadata
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
