修改core-site.xml

<property>
  <name>hadoop.security.key.provider.path</name>
  <value>kms://http@localhost:9600/kms</value>
  <description>
    The KeyProvider to use when interacting with encryption keys used
    when reading and writing to an encryption zone.
  </description>
</property>

修改kms-site.xml

 <property>
     <name>hadoop.kms.key.provider.uri</name>
     <value>jceks://file@/${user.home}/kms.keystore</value>
  </property>
  <property>
    <name>hadoop.security.keystore.java-keystore-provider.password-file</name>
    <value>kms.keystore.password</value>
  </property>

创建密钥容器keystore

密钥容器文件默认在/root目录下，需要保存到命令执行的用户目录（user.home）下，例如/home/hadoop等

keytool -genkey -alias 'kmskey' -keystore /root/kms.jks -dname "CN=localhost, OU=localhost, O=localhost, L=SH, ST=SH, C=CN" -keypass 123456 -storepass 123456 -validity 180

创建密钥容器访问口令存储文件

在HADOOP_HOME/etc/hadoop目录下执行如下命令
echo 123456 > /opt/kms.keystore.password