Take a DataNode Offline and Perform Data Transformation
The next step in activating CTE on HDFS is to switch a DataNode to offline and transform (encrypt) its sensitive data. Once the data is transformed, the HDFS Admin can add the DataNode to the HDFS Host/Client Group. Then they can switch the DataNode back to online. Most of these procedures are completed by the HDFS Administrator although one is done by the Administrator.
-
HDFS Administrator: Switch a DataNode to offline.
-
HDFS Administrator: Encrypt the files in the directories specified by
dfs.datanode.data.dir(see Configure NameNodes). -
Administrator: Create encryption keys and a data transformation policy to transform the data.
** CipherTrust Manager**
-
Administrator: After encrypting the data in those directories, add the DataNode host to the HDFS client group.
-
HDFS Admin: After the DataNode is added to the HDFS client group, activate the DataNode online.
-
Repeat this procedure for all of the DataNodes in your HDFS cluster.
For more information, see the CipherTrust Manager documentation.
