1. Ranger takes care of authorization. You will need something for authentication which is where kerberos and AD can come up. 2. You can set a /user/<username> in hdfs which is a user home directory. You might still need common hdfs directories where collaboration happens. 3. If you have AD, it will have kerberos. If you have write access to an OU in AD, you can create all service level principals there. So, no separate kerberos/KDC will be required. But if you don't want to create service level principals on AD, you can have local kerberos/KDC and have a one way trust with AD. 4. If you enable group based authorizations, adding users could be as easy adding user to the right group and creating a home directory for the user. 5. Ranger can take care of most authorizations and you can avoid working with ACLs. ... View more

It won't delete and recreate. So, if you mount /usr/hdp in advance, HDP will just use it ... View more

In case, you have to have edge node that a different OS, I suggest you use a manual approach by installing client packages (follow manual install document). Once installed, to get configs, you can clients on another node and download client configs. This will have some obvious overhead of keeping these configs in sync with ambari changes. Ambari Server and NN can be on the same node. Just make sure NN metadata directory, Journal Node data and zookeeper data goes into disk mounts that are not used by other services. Ambari Server, being a management console on top of hadoop can be considered non-critical. If ambari is down, and you need to restart a service, you can use the manual approach while you are working on bringing ambari server up. Unless you are using views, it will not be end users (considering cluster admins as not end users) that will be affected with ambari server going down. If you are using views, you can have multiple ambari servers running (with only views) ... View more

Are you using Hive CLI or Beeline/JDBC? 1. If you are using Hive CLI, then you need to control permissions on the HDFS. If you have 750 on the data in HDFS, and the user is part of the group, then the user will have only read only access. You can also user ACLs which are part of HDP 2.1.5. You can take a look at using ACLs here 2. If you are using Beeline, and set hive.server2.enable.doAs = true, then what you did on step 1, should be enough. If it is false and you are not using Storage Based authorization, then you will need to set permissions like in SQL with grant. ... View more