Support stronger ZooKeeper digest algorithms after 3.7.0
- Dominant language
- Java
- Stars
- 1.2k
- Forks
- 487
- Avg merge
- 4d 5h
- Merged PRs (30d)
- 13
Description
Accumulo uses ZooKeeper's DIGEST and the `instance.secret` in Accumulo's config file for protecting nodes in ZooKeeper with ACLs. ZooKeeper 3.7.0 added support for using stronger algorithms. On moving to some future Accumulo version that requires using ZooKeeper 3.7.0 or later as its minimum supported ZooKeeper version, Accumulo should take advantage of the ability to use a stronger digest algorithm.
At the very least, we should ensure upgrades work and we can still read/write to our ZK nodes if the system property is set to specify a stronger ACL digest algorithm if ZK 3.7.0 or later is used.
See:
https://issues.apache.org/jira/browse/ZOOKEEPER-3696
https://github.com/apache/zookeeper/pull/1756
https://github.com/apache/zookeeper/pull/1318
Contributor guide
Research direction
Start by tracing Accumulo's use of ZooKeeper DIGEST ACLs and instance.secret, then review the referenced ZooKeeper 3.7.0 changes and the system-property path for selecting the digest algorithm. Done means upgrades can still read and write existing ZooKeeper nodes and can use a stronger algorithm with ZooKeeper 3.7.0 or later.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- distributed-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100