Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

SOLVED Go to solution

Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

Good day.  We are working on a project to put our Impalad nodes behind a load balancer.  We are running CM/CDH 5.4.5 and using the instructions found here.

 

http://www.cloudera.com/content/www/en-us/documentation/enterprise/5-4-x/topics/impala_proxy.html#pr...

 

From what we observed, it looks like when using CM, after entering our load balancer dns:port (e.g. our.load.balancer.company.com:25003) into the "Impala Daemons Load Balancer" section, CM does most all the hard work of merging keytabs and setting the custom command line arguments (e.g. --be_principal) for us.  This is great.

 

Unfortunately after adding in our load balancer we are running into the error: "Role is missing Kerberos keytab." in CM.

 

Now, one of the things we were unsure of is whether CM will actually create the principal and keytab for the load balancer.  For example, when looking at our CM managed Kerberos principals, there is no "impala/our.load.balancer.company.com@COMPANY.COM"

 

Any idea if we need to pre-create and manage the 'impala/our.load.balancer.company.com@COMPANY.COM' outside of CM?  Or would you expect CM to actually create that principal for us as part of adding in the “Impala Daemons Load Balancer” configuration?

 

Thanks in advance.

 

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

You just need to go to the kerberos page and generate the missing keytab.

Administration -> Security, click the tab for Kerberos Credentials, click Generate Missing Credentials.

Thanks,
Darren
2 REPLIES 2

Re: Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

You just need to go to the kerberos page and generate the missing keytab.

Administration -> Security, click the tab for Kerberos Credentials, click Generate Missing Credentials.

Thanks,
Darren
Highlighted

Re: Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

Thanks!  Indeed that seemed to take care of it.  Pretty slick.  You guys did a very good job on making that easy for us.

 

Now to start testing.  Thanks again!