apache / apache/accumulo

Support stronger ZooKeeper digest algorithms after 3.7.0

Open
#2,288 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
1.2k
Forks
487
Avg merge
4d 5h
Merged PRs (30d)
13

Description

Accumulo uses ZooKeeper's DIGEST and the `instance.secret` in Accumulo's config file for protecting nodes in ZooKeeper with ACLs. ZooKeeper 3.7.0 added support for using stronger algorithms. On moving to some future Accumulo version that requires using ZooKeeper 3.7.0 or later as its minimum supported ZooKeeper version, Accumulo should take advantage of the ability to use a stronger digest algorithm.

At the very least, we should ensure upgrades work and we can still read/write to our ZK nodes if the system property is set to specify a stronger ACL digest algorithm if ZK 3.7.0 or later is used.

See:

https://issues.apache.org/jira/browse/ZOOKEEPER-3696
https://github.com/apache/zookeeper/pull/1756
https://github.com/apache/zookeeper/pull/1318

Contributor guide

Open the contributing guide

Research direction

Start by tracing Accumulo's use of ZooKeeper DIGEST ACLs and instance.secret, then review the referenced ZooKeeper 3.7.0 changes and the system-property path for selecting the digest algorithm. Done means upgrades can still read and write existing ZooKeeper nodes and can use a stronger algorithm with ZooKeeper 3.7.0 or later.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
distributed-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.