10-16-2018 06:49 AM
I've been able to configure our cluster with a local kerberos realm using the usual /etc/krb5.conf file.
The thing is... we need to change the path that the system will use.
Basically the customer is using the path /etc/krb5.conf with something else, but we need to setup Cloudera Manager (and the rest of the big data services) to use a different krb5.conf location.
Anyone know how to perform this change in Cloudera Manager (cluster wide)? To use a different krb5.conf file, other than the usual /etc/krb5.conf?
10-17-2018 03:28 PM
Currently there is no way to automate this in Cloudera Manager, but it is possible via manual configuration for each service, the agents, and Cloudera Manager (as well as the shell if you are using hadoop commands at the command line).
I would like to do some extensive testing at some point, but, for now, you can use the following:
Java will use the following configuration if set for that JVM:
If java.security.krb5.conf is not set, then java will look in the following locations:
MIT Kerberos-based servers can be configured with the following environment variable:
With the above rules in mind, these general steps can be followed:
Place your custom krb5.conf in the "jre/lib/security" subdirectory of your JDK's directory.
Make sure it is read for all in terms of file permissions (so that all service users can read from it)
Any client or server that uses that JDK will then automatically read from your customer krb5.conf rather than /etc.krb5.conf
* this includes Cloudera Manager
NOTE: The draw-back of doing it this way is that if you upgrade Java, you will need to remember to put your krb5.conf in place.
NOTE2: If you choose to use -Djava.security.krb5.conf instead, that will require configuring it for all servers and clients in safety valves, files, etc. The plus of this config, though, is that you do not have to remember to put your krb5.conf in place during upgrades of JDK.
For all agents in your cluster, add this to /etc/default/cloudera-scm-agent:
Add the following to Hue Service Environment Advanced Configuration Snippet (Safety Valve)
Add the following to Impala Service Environment Advanced Configuration Snippet (Safety Valve)
You may also need to add to Impala Daemon Environment Advanced Configuration Snippet (Safety Valve):
Restart EVERYTHING (cluster, management service, agents, Cloudera Manager)
That should give you a good start.
10-18-2018 12:56 AM - edited 10-18-2018 02:43 AM
Dude, with this reply you should really get a raise!
Thanks! We will test this solution! Thank you so much!
After some tests the solution is correct! It worked :)
10-23-2018 03:01 AM - last edited on 10-23-2018 05:32 AM by cjervis
Just a few changes I've detected.
In the agent configuration don't use EXPORT.
In /etc/default/cloudera-scm-agent just add:
Also, you will need to hammer Kerberos Server and Kadmin files.
KDC -> /etc/sysconfig/krb5kdc
Kadmin -> /etc/sysconfig/kadmin
This will allow you to start both services after you create the databases (kdb5_util create -s). If you don't do this, kerberos will still read /etc/krb5.conf and weird stuff will appear.
LET'S GO PEOPLE!!! :D Hammer on!