Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

Mac Noland BS — Fri, 16 Sep 2022 09:51:01 GMT

Good day. We are working on a project to put our Impalad nodes behind a load balancer. We are running CM/CDH 5.4.5 and using the instructions found here.

http://www.cloudera.com/content/www/en-us/documentation/enterprise/5-4-x/topics/impala_proxy.html#proxy_kerberos_unique_1

From what we observed, it looks like when using CM, after entering our load balancer dns:port (e.g. our.load.balancer.company.com:25003) into the "Impala Daemons Load Balancer" section, CM does most all the hard work of merging keytabs and setting the custom command line arguments (e.g. --be_principal) for us. This is great.

Unfortunately after adding in our load balancer we are running into the error: "Role is missing Kerberos keytab." in CM.

Now, one of the things we were unsure of is whether CM will actually create the principal and keytab for the load balancer. For example, when looking at our CM managed Kerberos principals, there is no "impala/our.load.balancer.company.com@COMPANY.COM"

Any idea if we need to pre-create and manage the 'impala/our.load.balancer.company.com@COMPANY.COM' outside of CM? Or would you expect CM to actually create that principal for us as part of adding in the “Impala Daemons Load Balancer” configuration?

Thanks in advance.

Re: Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

Darren — Wed, 02 Dec 2015 21:13:07 GMT

You just need to go to the kerberos page and generate the missing keytab.

Administration -> Security, click the tab for Kerberos Credentials, click Generate Missing Credentials.

Thanks,
Darren

Re: Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

Mac Noland BS — Wed, 02 Dec 2015 21:34:16 GMT

Thanks! Indeed that seemed to take care of it. Pretty slick. You guys did a very good job on making that easy for us.

Now to start testing. Thanks again!

question Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM in Archives of Support Questions (Read Only)

Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

Re: Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

Re: Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM