Take a DataNode Offline and Perform Data Transformation

The next step in activating CTE on HDFS is to switch a DataNode to offline and transform (encrypt) its sensitive data. Once the data is transformed, the HDFS Admin can add the DataNode to the HDFS Host/Client Group. Then they can switch the DataNode back to online. Most of these procedures are completed by the HDFS Administrator although one is done by the Administrator.

1. HDFS Administrator: Switch a DataNode to offline.

2. HDFS Administrator: Encrypt the files in the directories specified by dfs.datanode.data.dir (see Configure NameNodes).

3. Administrator: Create encryption keys and a data transformation policy to transform the data.

   CipherTrust Manager

   

4. Administrator: After encrypting the data in those directories, add the DataNode host to the HDFS client group.

5. HDFS Admin: After the DataNode is added to the HDFS client group, activate the DataNode online.

6. Repeat this procedure for all of the DataNodes in your HDFS cluster.

For more information, see the CipherTrust Manager documentation.