Resources

Short Description:Describes ways to manually regenerate keytabs for services through Ambari REST API ArticleMake sure KDC credentials are added to Ambari credentials store. You can follow this Article to perform. Once KDC credentials are added. You can use the below Ambari's REST API to regenerate keytabs.curl -H "X-Requested-By:ambari" -u <Ambari_Admin_username>:<Amabri_Admin_password> -X PUT -d '{ "Clusters": { "security_type" : "KERBEROS" } }' http://<Ambari_HOST>:8080/api/v1/clusters/<Cluster_Name>/?regenerate_keytabs=allExample : curl -H "X-Requested-By:ambari" -u admin:admin -X PUT -d '{ "Clusters": { "security_type" : "KERBEROS" } }' http://172.26.108.142:8080/api/v1/clusters/vinod/?regenerate_keytabs=all&ignore_config_updates=trueOnce the Keytabs are regenerated it requires Service restart to use the newly generated keytabs.

Pre-requisites: 1. You need to have the correct passwords2. The PrivateKey of the CA is required to sign off all the agent certificates.3. Password for the pass.txt file will be present in clear-text format. And currently, there is no way to encrypt it. Steps: Back up and delete all the crt and csr files that start with hostname at /var/lib/ambari-server/keys.tar -cvzf keys_directory.tar.gz /var/lib/ambari-server/keys/* Empty /var/lib/ambari-server/keys/db/index.txt filemv /var/lib/ambari-server/keys/db/index.txt /tmp Delete any certificates under /var/lib/ambari-server/keys/db/newcerts/mv /var/lib/ambari-server/keys/db/newcerts/* /tmp Configure CA-signed certificate artifacts in Ambari Server by: Copy the CA-signed certificate, key files to /var/lib/ambari-server/keys/ e.g. rootca.crt, root_server.key Create PKCS keystore file from your certificate and key files.openssl pkcs12 -export -in rootca.crt -inkey /var/lib/ambari-server/keys/root_server.ke

Objective This article will share what options a user has when they have lost or forgot the password set for the nifi.sensitive.props.key in the nifi.properties file. What is the nifi.sensitive.props.key?---------------------------------------------- The nifi.sensitive.props.key is used to encode any NiFi component added to the NiFi's canvas that has a sensitive property configured with a value (passwords). These "enc{...}" strings are set in the flow.xml.gz that is generated by NIFi, which includes everything dataflow-related set through the NiFi UI. How the nifi.sensitive.props.key gets set has varied over the history of NiFi. In some releases, NiFi would automatically generate a random password when the user did not set the property when NiFi was first launched. The current release requires that a user set this property or NiFi will not start. The nifi.sensitive.props.key is coupled closely with the flow.xml.gz. The flow.xml.gz file can be migrated to other

Objective This tutorial walks you through how to install and setup a local Hortonworks Registry to interact with Apache NiFi.Environment This tutorial was tested using the following environment and components: Mac OS X 10.11.6 MySQL 5.7.13 Apache NiFi 1.3.0 Hortonworks Registry 0.2.1 Note: The record-oriented processors and controller services used in the demo flow of this tutorial were in introduced in NiFi 1.2.0. As such, the tutorial needs to be done running Version 1.2.0 or later. Currently, Hortonworks Registry 0.2.1 is the version compatible with NiFi 1.3.0.Environment ConfigurationHortonworks Registry Installation Download the 0.2.1 Registry release: hortonworks-registry-0.2.1.tar.gz Extract the tar: tar xzvf hortonworks-registry-0.2.1.tar.gzMySQL Database Setup Login to your MySQL instance and create the schema registry database and necessary users and privileges: unix> mysql -u root -punix> Enter password:<enter>mysql> create database schema_regis

With the new runtimes feature available for both CML and CDSW, it is now possible to make better use of the remote editing capabilities with VS Code. To use this feature you will need VS Code installed locally and a CML/ CDSW instance that supports runtimes, and has the remote editing enabled (it is enabled by default but it can be disabled in the Admin settings) and that you can reach the server from the remote point you're connecting from. If you have all of that enabled, you are good to go. Step 1 - Configure cdswctl CLI For the first step, you will need to have a copy of the cdswctl command line tool on your local machine. You can get the cli directly from the CML/CDSW instance by going to User Settings > Remote Editing. The installation process is documented here and you need to get a version that works for your local OS. I'm on a Mac and I have the cdswctl cli in my /usr/local/bin directory:   % which cdswctl/usr/local/bin/cdswctl   To connect to your CML/CDSW

To demonstrate what is happening here, see these steps and output.Create a database at a custom location: 0: jdbc:hive2://hostname.cloudera.co> create database grandtourlocation 'hdfs://hostname.cloudera.com:8020/bdr-test/grandtour.db';<TRUNCATED>INFO : Executing command(queryId=hive_20210818180811_d96dd7f8-2713-440f-8e9f-8eebd2954d05): create database grandtour location 'hdfs://hostname.cloudera.com:8020/bdr-test/grandtour.db'INFO : Starting task [Stage-0:DDL] in serial modeINFO : Completed executing command(queryId=hive_20210818180811_d96dd7f8-2713-440f-8e9f-8eebd2954d05); Time taken: 0.031 secondsINFO : OKNo rows affected (0.083 seconds) Create a table and insert a record: 0: jdbc:hive2://hostname.cloudera.co> use grandtour;<TRUNCATED>INFO : Completed executing command(queryId=hive_20210818180835_f365f042-e2a9-4f53-a9ed-317d21dcfc07); Time taken: 0.008 secondsINFO : OKNo rows affected (0.065 seconds)0: jdbc:hive2://hostname.cloudera.co> creat

In this example, I am importing encryption keys from HDP 3.1.5 cluster to an HDP 2.6.5 cluster.Create key "testkey" in Ranger KMS HDP 3.1.5 cluster with steps: List and Create Keys. In HDP 3.1.5, the current master key is:Encryption Key:Create an encryption zone with the "testkey": [hdfs@c241-node3 ~]$ hdfs crypto -createZone -keyName testkey -path/testEncryptionZoneAdded encryption zone /testEncryptionZone List to confirm the zone and keys: [hdfs@c241-node3 ~]$ hdfs crypto -listZones/testEncryptionZone testkey Export the keys:Log in to KMS hostexport java homecd /usr/hdp/current/ranger-kms./exportKeysToJCEKS.sh $filenameThe output will look as follows: [root@c241-node3 ranger-kms]# export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64/jre[root@c241-node3 ranger-kms]# ./exportKeysToJCEKS.sh /tmp/hdp315keys.keystoreEnter Password for the keystore FILE :Enter Password for the KEY(s) stored in the keystore:Keys from Ranger KMS Database

Introduction Thrift proxy is a modern micro-service framework when comparing to other existing frameworks such as SOAP/JSON-RPC/Rest proxy. The Thrift proxy API has a higher performance, is more scalable, and is multi-language supported. (C++, Java, Python, PHP, Ruby, Perl, C#, Objective-C, JavaScript, NodeJs, and other languages). The application can interact with HBase via Thrift proxy. This article will discuss how to use correct libraries and methods to interact with HBase via Thrift proxy.  Outline The basic concept of Thrift proxy and how the thrift language bindings are generated. How Python thrift functions align with the correct settings of HBase configurations from Cloudera Manager. Sample client codes in security disabled/ enabled HBase clusters. Some known bugs when using TSaslClientTransport with Kerberos enabled in some CDP versions. The basic concept of Thrift proxy and how the Thrift cross-language bindings are generated The Apache Thrift library provides cross-

In Hortworks HCP they use an ElasticSearch Mpack for version 5.x of Elasticsearch and Kibana:http://public-repo-1.hortonworks.com/HCP/centos7/1.x/updates/1.6.0.0/tars/metron/elasticsearch_mpack-1.6.0.0-7.tar.gzI have taken this and expanded it to include version 6.3.2 of ElasticSearch, Logstash, Kibana, FileBeat, and MetricBeat.My cluster is 6 nodes.ElasticSearch is installed on Nodes 4,5,6(4 Master & 5,6 Data Nodes).Logstash is Installed on Node 3.FileBeat & MetricBeat are installed on all 6 nodes.Kibana is installed on Node 4.The rest of the cluster is configured normally for a minimal Install.DownloadsOrginal HCP Mpackelasticsearch-mpack-1600-7.tar.gzMy MPack 6.3.0 - Version Change + Logstash + Beatselasticsearch-mpack-2500-9.tar.gzMy Mpack 6.3.2 - Version Change + Logstash (multi-node & jvm settings config) + sudo non root capabilitieselasticsearch-mpack-2600-9.tar.gzInstallation Steps1. Deliver Management Pack tar.gz to local filesystem on Ambari-Serverupload to hdfs v

CEM What is Cloudera Edge Management (CEM)?Refer to What is Cloudera Edge Management. There is no compatibility matrix between CEM and HDF because these are independent products and MiNiFi agents from CEM will be perfectly fine to send data into HDF/NiFi, if they need to. SMM From Install or Upgrade Ambari, HDF, and HDP document, we can see that the rge cluster must be managed by Ambari 2.7.x. It can be an HDF 3.3.x, 3.4.0 or 3.4.1.1 cluster, or an HDP 3.1 or 3.1.1 cluster. And in Set up DP Platform document, you can see that before installing Streams Messaging Manager, you must first install or upgrade to DataPlane Platform 1.2.x   My understanding is: SMM is based on Dataplane Platform, so if you installed the latest Dataplane Platform, there is no way you cannot install the latest SMM. So, I believe DPS (DataPlane Platform) 1.3.1 or 1.3.0 and SMM 2.0.0 are compatible.   Actually, if you look at Installing DataPlane document, it looks to me th

   My Kubernetes series  (Part1, Part2) was strictly focused on MiNiFi on K8S.  NiFi and MiNiFi may communicate over Site 2 Site; however, often the pattern is to leverage Kafka for a clean message handoff.  NiFi within these patterns is generally the central router and transformer of messages.  Think of it like "FedEx" for data.   Till now most have deployed NiFi on bare metal or VMs.  Natural evolution kicks in. Deploy NiFi on k8s and yes it's super simple.  In this article I will demonstrate how to deploy both a NiFi and ZooKeeper cluster (none being a single pod!) on Azure Kubernetes Service (AKS); however, all artifacts may be leveraged to deploy on virtually any kubernetes offering. PrerequisitesSome knowledge of Kubernetes and NiFiAKS / k8s Clusterkubectl cliNiFi image available in a registry (ie dockerhub) DeploymentAll the contents in the ymls below can be placed into single file for deployment.  F

Introduction Phoenix is a popular solution to provide OLTP and operational analytics on top of HBase for low latency. Hortonworks Data Platform (HDP), Cloudera are the most popular platforms for Phoenix to interact with HBase. Nowadays, many customers choose to migrate to Cloudera Data Platform to better manage their Hadoop clusters and implement the latest solutions in big data. This article discussed how to migrate Phoenix data/index tables to the newer version CDP Private Cloud Base. Environment Source cluster HDP 2.6.5 , HDP 3.1.5 Target cluster CDP PvC 7.1.5, CDP PvC 7.1.6, CDP PvC 7.1.7 Migration steps The SYSTEM table will be automatically created when Phoenix-sqlline initially starts. It will contain the metadata of Phoenix tables. In order to show Phoenix data/index tables in the target cluster, we need to migrate SYSTEM tables from the source cluster as well. Stop Phoenix service on the CDP clusterYou can stop the service on Cloudera Manager > Services > Phoenix

Introduction This article is part of a series (see part 1, part 2, part 3 and part 5). Here we look at how to avoid some common NameNode performance issues. Audience This article is for Apache Hadoop administrators who are familiar with HDFS and its components. If you are using Ambari or Cloudera Manager, you should know how to manage services and configurations. Avoid Disk Throughput Issues The performance of the HDFS NameNode depends on being able to flush its edit logs to disk relatively quickly. Any delay in writing edit logs will hold up valuable RPC handler threads and can have cascading effects on the performance of your entire Hadoop cluster. You should use a dedicated hard disk i.e. dedicated spindle for the edit logs to keep edits flowing to the disk smoothly. The location of the edit log is configured using the dfs.namenode.edits.dir setting in hdfs-site.xml. If dfs.namenode.edits.dir is not configured, it defaults to the same value as dfs.namenode.name.dir. Exampl

Hi All, I have faced some issues. We want to dedicate one of the Zeppelin node to a different agency. So, if they create any notebook, those are getting synced to every one after a restart because we are using the central storage system as HDFS. So, Zeppelin nodes are picking all notebooks and interpreter settings from the HDFS single path. To avoid this, we isolated the settings and configurations by changing Zeppelin to use the local storage, so each node will act independently. For the same, the following are helpful steps in case anyone is facing the same. Thanks.   Verify the procedures in a lower environment before executing the same in production.sudo -u <zeppelin-user> mkdir -p /var/lib/zeppelin/conf /var/lib/zeppelin/notebookkinit <zeppelin-user>hdfs dfs -get "/user/zeppelin/notebook/*" /var/lib/zeppelin/notebookhdfs dfs -get /user/zeppelin/conf/notebook-authorization.json /var/lib/zeppelin/conf​   In the Zeppelin configuration page, search for an

In this tutorial, we will learn how to create Apache Ozone volumes, buckets, and keys. After that, we will see how to create an Apache Hive table using Apache Ozone, and finally how we can insert/read the data from Apache Spark. Ozone Create the volume with the name vol1.# ozone sh volume create /vol121/08/25 06:23:27 INFO rpc.RpcClient: Creating Volume: vol1, with root as owner. Create the bucket with the name bucket1 under vol1.# ozone sh bucket create /vol1/bucket121/08/25 06:24:09 INFO rpc.RpcClient: Creating Bucket: vol1/bucket1, with Versioning false and Storage Type set to DISK and Encryption set to false     Hive Launch the beeline shell. Create the employee table in Hive. Note: Update the om.host.example.com value.   CREATE DATABASE IF NOT EXISTS ozone_db;USE ozone_db;CREATE EXTERNAL TABLE IF NOT EXISTS `employee`( `id` bigint, `name` string,

Summary of the article I have encountered issues of the following scenario several times: A customer removes a host from a cluster managed by Cloudera Manager and adds the host to another cluster managed by Cloudera Manager. At this time, problems often occur. These problems are often caused by the old cluster files remaining on the host, and these old files cause the new Cloudera Manager to be unable to control the host normally. So I verified what files will be generated on a host after adding it to a CDP cluster managed by Cloudera Manager.In other words, after removing a host from Cloudera Manager, what files do we need to delete manually? Introduction to the Test environment CDP Runtime version: CDP PvC Base 7.1.6 CM version: Cloudera Manager 7.3.1 Whether to enable Kerberos: Yes Whether to enable TLS: Yes Auto-TLS: Yes Auto-TLS Use Case: Use Case 1 - Using Cloudera Manager to generate an internal CA and corresponding certificates (Refer to Configuring TLS Encryption for Clo

A common request from CDE users is the ability to specify a timeout (or SLA) for their Spark job. This is easily configured by leveraging CDE's embedded Airflow sub-service, which provides a rich set of workflow management and scheduling features, along with Cloudera Data Platform (CDP-specific) operators such as CDEJobRunOperator and CDWOperator.   As a simple example, the steps below create a CDE Spark job, which is then triggered from a CDE Airflow Task, also making use of the execution_timeout Airflow Task parameter to specify an SLA after which the Spark job should be killed. We'll use the pi.py sample code as our CDE Spark job, and the following Airflow DAG definition (airflow_dag_with_task_timeout.py)   from datetime import datetime, timedeltafrom airflow import DAGfrom airflow.operators.dummy_operator import DummyOperatorfrom cloudera.cdp.airflow.operators.cde_operator import CDEJobRunOperatordefault_args = { 'owner': 'cdeuser1', 'retry_delay': timed

How to Submit Spark Application through Livy REST APIApache Livy supports using REST APIs to submit Spark applications, it is quite similar to use “spark-submit” in vanilla Spark. In this article we will briefly introduce how to use Livy REST APIs to submit Spark applications, and how to transfer existing “spark-submit” command to REST APIs.Using spark-submitIn vanilla Spark, normally we should use “spark-submit” command to submit Spark application to a cluster, a “spark-submit” command is like:./bin/spark-submit \ --class <main-class> \ --master <master-url> \ --deploy-mode <deploy-mode> \ --conf <key>=<value> \ ... # other options <application-jar> \ [application-arguments]Some of the key options are: --class: The entry point for your application (e.g. org.apache.spark.examples.SparkPi).--master: The master URL for the cluster (e.g. spark://23.195.26.187:7077).--deploy-mode: Whether to deploy your driver on the worker nodes (cluster) or lo

File processing + autoscaling seems to have an antinomic relationship. It doesn't have to be..really.  Autoscaling often drives inefficient behaviors..why? The concomitant response... "It Autoscales". Autoscaling still requires sound design principles. Without that, It won't autoscale well.   Autoscaling within a distributed framework requires proper data dichotomization along with processing/service layer decoupling Anti-Pattern Taking an example of where I've seen the most amount of heartburn. Large files (i.e. zip/tar/etc) land in s3/Storage area. The knee-jerk reaction is to feed it into a distributed processing engine that autoscales. The "autoscaling" part appropriately. It may. Most likely you're flipping a coin and lighting a candle, hoping that all works out. What if the file sizes are heterogeneous and the variances between them could be quite significant? What about error handling? Does it have to be all or nothing (meaning all files need to be processi

Recently I was tasked to build a possible pattern regarding how to handle slowing changing dimensions (Type 2 to be specific) within CDP. The obvious answer is to use Hive ACID, but clearly, that answer is too generic. I needed to build a pipeline similar to what I used to do as an Informatica developer and verify legitimacy to the solution/pattern. Here we go. Why? The objective was to build a possible (one of many) pattern on how to handle SCD Type 2 dimensions with CDP.  Outcome: I was able to repeat a typical ETL workflow with CDP.  How? By taking off my horse blinders...Really. What are SCDs? For those who may not be family with slowly changing dimensions within a EDW context, here is a great quick read: Types Of Dimension Tables How? Data lands in a sourcing area Super typical Pull source data & run it through a cleaning/processing layer for staging Ready for merging against SCD table Run an ACID merge between stage and SCD Table Not rocket scien

This article outlines the steps needed to setup ODBC access to Hive via Apache Knox from a Linux workstation. While there seems to be some "reasonable" documentation other there on setting up this access from Windows, it took quite some time to figure out how to do this from Linux. For this example, I am installing the Hortonworks Linux ODBC driver on CentOS Linux release 7.2.1511 then verifying it works using both the isql ODBC command line tool and PyODBC. Installation Steps 1) Install the UnixODBC Dependencies sudo yum install unixODBC 2) Download and Install Hortonworks ODBC Linux Driver I developed this guide using the below version of the driver. Note that the following URL is for the CentOS 7 version of the driver. If you are running an older version of the OS, then visit https://hortonworks.com/downloads/ and use the CentOS 6 driver. Also note that the below URL will likely change as new versions of the driver are released so it is a good idea to check the Hortonworks downloa

In this article, we will learn how to register a Hive UDFs using Spark HiveWarehouseSession. Download and build the Spark Hive UDF example.git clone https://github.com/rangareddy/spark-hive-udfcd spark-hive-udfmvn clean package -DskipTests Copy the target/spark-hive-udf-1.0.0-SNAPSHOT.jar to the edge node. Login to edge node and upload the spark-hive-udf-1.0.0-SNAPSHOT.jar to HDFS location for example, /tmp.hdfs dfs -put ./brickhouse-0.7.1-SNAPSHOT.jar /tmp Launch the spark-shell with 'hwc' parameters.spark-shell \ --jars /opt/cloudera/parcels/CDH/jars/hive-warehouse-connector-assembly-*.jar \ --conf spark.sql.hive.hiveserver2.jdbc.url='jdbc:hive2://hiveserver2_host1:2181/;serviceDiscoveryMode=zooKeeper;zooKeeperNamespace=hiveserver2' \ --conf spark.sql.hive.hwc.execution.mode=spark \ --conf spark.datasource.hive.warehouse.metastoreUri='thrift://metastore_host:9083' \ --conf spark.datasource.hive.warehouse.load.staging.dir='/tmp' \ --conf spark.datasource.hive.warehouse.us

Money management and retirement planning are extremely important issues. The conventional wisdom says to get a Financial Advisor who will invest your money and allow you to reach your financial goals. However, as of late, financial institutions have began to offer services generally referred to as Digital Advisors or "Robo Advisors". These services aim to offer a very low cost, broad spectrum, long term investment advice across a limited set of financial products. The advice is personalized based on basic input from the customer such as level of risk tolerance, initial investment, years to invest, ect. The basic premise behind the offering is diversification. Statistics have shown that few money managers are able to beat the S&P 500 over the long term, especially after fees. The Digital Advisor aims to spread the initial investment across a broad spectrum of securities at a much lower cost. The Digital Advisor provides another major advantage over the Human Financial Advisor. Using

ContextAs of CDP 7.1.2, Sentry is deprecated with Kudu, and Ranger becomes the solution for Fine-Grained Authorization in Kudu. The question this article is meant to address is what does it mean for the Impala/Kudu stack to enable Ranger for Kudu, especially if Impala is already using Ranger? This is not obvious up front because the information is spread over three different sets of documents. Fundamentally the answer is nothing. The reason for this is straightforward: enabling the Kudu module in Ranger should automatically configure the --trusted_user_acl flag in Kudu to include Impala (if installed) and Hive (if installed). What this flag does is exempt the listed users from being checked against Kudu's authorization model, which in CDP installations mean Ranger policies. So, the correct way to enforce access to Impala and Hive tables, which are stored as Kudu, is the Hadoop-SQL policies set for Impala and Hive. By default, enabling Ranger for Kudu should have no impact on

Continuing my series of how-to articles for CDP, today we explore how to connect to Impala via JDBC in JSON. In my example, I will use a Jupyter notebook running in CML, but this can be generalized. This process is actually fairly easy, so let's dive in. Step 1: Setup Impala JDBC drivers First, download the latest impala JDBC drivers from Cloudera JDBC Driver 2.6.17 for Impala. Then, upload them to your machine. Here is an example of a CML Jupyter sessions with the jars uploaded: Finally, make sure that you set up your CLASSPATH properly by opening a terminal session and typing the following: CLASSPATH=.:/home/cdsw/ImpalaJDBC4.jar:/home/cdsw/ImpalaJDBC41.jar:/home/cdsw/ImpalaJDBC42.jarexport CLASSPATH​ Step 2: Install JayDeBeApi To install JayDeBeApi, run the following:pip3 install JayDeBeApi ​ A recommended step to avoid getting an error along the lines of "AttributeError: type object 'java.sql.Types' has no attribute '__javaclass__'", would be to downgrade your jpype by runn