Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Navigator can not encrypt the old data, right?

SOLVED Go to solution

Navigator can not encrypt the old data, right?

Explorer

if enable Navigator after CDH has run for long time, the old data can not be encrpted, and the new encrypted data also can not be palced into the old diretory. right?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Navigator can not encrypt the old data, right?

Explorer

Hi Dave,

 

The encryption requies empty HDFS directory to begin with as per the design.  I'm afraid that you can't encrypt the old data which is already present.  Please refer the below link and there were some good discussion a the end.

 

http://blog.cloudera.com/blog/2015/01/new-in-cdh-5-3-transparent-encryption-in-hdfs/

 

Cheers

Nagaraj C

3 REPLIES 3

Re: Navigator can not encrypt the old data, right?

Explorer
any ideas?

Re: Navigator can not encrypt the old data, right?

Explorer

Hi Dave,

 

The encryption requies empty HDFS directory to begin with as per the design.  I'm afraid that you can't encrypt the old data which is already present.  Please refer the below link and there were some good discussion a the end.

 

http://blog.cloudera.com/blog/2015/01/new-in-cdh-5-3-transparent-encryption-in-hdfs/

 

Cheers

Nagaraj C

Re: Navigator can not encrypt the old data, right?

Contributor

Assuming that you are referencing Cloudera Navigator Encrypt, as part of the process of encrypting a disk, you can move existing data onto that newly encrypted disk.  See the navencrypt-move command.

 

If you are referring to HDFS Transparent Encryption, then you must create a new encryption zone in HDFS (effectively a new directory) and then copy your HDFS data into it.  A lot of people ask "How can I encrypt an existing directory".  You would have to perform two extra steps and have plenty of available disk space: 

1. Rename the existing directory in HDFS: "hdfs dfs -mv /data /data.bak"

2. Set up the encryption zone for /data. "hadoop key create <keyname>; hdfs dfs -mkdir /data; hdfs crypto -createZone -keyName <keyname> -path /data"

3. Copy the data in /data.bak to /data. "hdfs dfs -cp /data.bak/\* /data/"

4. Remove /data.bak. "hdfs dfs -rm -R /data.bak"