Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

avatar
Contributor

Good day.  We are working on a project to put our Impalad nodes behind a load balancer.  We are running CM/CDH 5.4.5 and using the instructions found here.

 

http://www.cloudera.com/content/www/en-us/documentation/enterprise/5-4-x/topics/impala_proxy.html#pr...

 

From what we observed, it looks like when using CM, after entering our load balancer dns:port (e.g. our.load.balancer.company.com:25003) into the "Impala Daemons Load Balancer" section, CM does most all the hard work of merging keytabs and setting the custom command line arguments (e.g. --be_principal) for us.  This is great.

 

Unfortunately after adding in our load balancer we are running into the error: "Role is missing Kerberos keytab." in CM.

 

Now, one of the things we were unsure of is whether CM will actually create the principal and keytab for the load balancer.  For example, when looking at our CM managed Kerberos principals, there is no "impala/our.load.balancer.company.com@COMPANY.COM"

 

Any idea if we need to pre-create and manage the 'impala/our.load.balancer.company.com@COMPANY.COM' outside of CM?  Or would you expect CM to actually create that principal for us as part of adding in the “Impala Daemons Load Balancer” configuration?

 

Thanks in advance.

 

1 ACCEPTED SOLUTION

avatar
You just need to go to the kerberos page and generate the missing keytab.

Administration -> Security, click the tab for Kerberos Credentials, click Generate Missing Credentials.

Thanks,
Darren

View solution in original post

2 REPLIES 2

avatar
You just need to go to the kerberos page and generate the missing keytab.

Administration -> Security, click the tab for Kerberos Credentials, click Generate Missing Credentials.

Thanks,
Darren

avatar
Contributor

Thanks!  Indeed that seemed to take care of it.  Pretty slick.  You guys did a very good job on making that easy for us.

 

Now to start testing.  Thanks again!