question Re: Multihomed? in Archives of Support Questions (Read Only)

Multihomed?

mimmus — Fri, 16 Sep 2022 10:44:46 GMT

Hi,

we got some issues while planning a secure Cloudera cluster.

The situation is as follows:

- All host are multihomed, i.e. they have two separate IP addresses connected to two separate LANs. One is intended for interaction with the enterprise network and one for intra-cluster traffic. The intra-cluster network is not accessible from the outside.

- Each IP-address is associated with a separate hostname, e.g. host-internal.domain.com and host-enterprise.domain.com. The internal hostname is used as primary hostname and used in all Hadoop configurations.

- The DNS does resolve the hostnames consistent in all networks. There is no way to resolve the same hostname different depending on the network you are in.

Now I'm planning to set up Kerberos with an AD, that is placed in the enterprise network. I expect to see issues, as hadoop hosts will talk to the KDC via the external address but resolve itself to the internal hostname. I suspect that the Kerberos hostname validation will fail, as the KDC resolves the external IP to the external hostname.

Do you have any ideas, how to best handle this situation?

Re: Multihomed?

MicheleM — Wed, 19 Oct 2016 14:09:07 GMT

Hi,

I think that the major problem is that the each host have two hostname.

When I configure multihomed cluster with AD integration I will:

- assign one hostname for every host

- internally the hostname resolve to internal IP, via hosts file or via internal DNS. So the

- from outside the hostname resolve to extenal IP, via external DNS

When Cloudera Manager creates the principal for the pairs <service>/<hostname> the hostname is consistent both for internal and external network.

Re: Multihomed?

mimmus — Wed, 19 Oct 2016 14:21:17 GMT

Interesting!
There is only the overhead to mantain a hosts file.

A real problem is that Cloudera doesn't support multihomed conifigs 😞

Re: Multihomed?

mimmus — Thu, 20 Oct 2016 09:30:57 GMT

Tested now: it works!
But we prefer to adopt a plain network config to avoid issues in the future.