In the 4.5.0 release, the BookKeeper community added a number of features that can be used, together or separately, to secure a BookKeeper cluster.
The following security measures are currently supported:
Authentication of connections to bookies from clients, using either TLS or SASL (Kerberos).
Authentication of connections from clients, bookies, autorecovery daemons to ZooKeeper, when using zookeeper based ledger managers.
Encryption of data transferred between bookies and clients, between bookies and autorecovery daemons using TLS.
It’s worth noting that security is optional - non-secured clusters are supported, as well as a mix of authenticated, unauthenticated, encrypted and non-encrypted clients.
NOTE: authorization is not yet available in 4.5.0. The Apache BookKeeper community is looking to add this feature in subsequent releases.
An entry is a sequence of bytes (plus some metadata) written to a BookKeeper ledger. Entries are also known as records.
A ledger is a sequence of entries written to BookKeeper. Entries are written sequentially to ledgers and at most once, giving ledgers append-only semantics.
A bookie is an individual BookKeeper storage server.
Bookies store the content of ledgers and act as a distributed ensemble.
A subsystem that runs in the background on bookies to ensure that ledgers are fully replicated even if one bookie from the ensemble is down.
Striping is the process of distributing BookKeeper ledgers to sub-groups of bookies rather than to all bookies in a BookKeeper ensemble.
Striping is essential to ensuring fast performance.
A journal file stores BookKeeper transaction logs.
When a reader forces a ledger to close, preventing any further entries from being written to the ledger.
A record is a sequence of bytes (plus some metadata) written to a BookKeeper ledger. Records are also known as entries.