@Chris Nauroth Chris, It's completely based on the business requirement. Personally, I don't suggest for HTTP auth to my customer because compliance requirement requires minimum 2 factor authentication. Logging into Ambari using LDAP/AD credentials and then Kerberos takes care of it. Setting up HTTP auth for each web ui adds more work for admin/users to access web pages ( definitely not strong reason for not setting it up) ... View more

@jeden@hortonworks.com Thanks for asking this question. I could not find any specific docs and looks like it's straight forward from Ambari end ( as you said it already) Under Yarn --> Config ( 2 features, Node label and Pre-emption - not relevant to this question) Link enable label - yarn.node-labels.enabled Doc mentioned to configure root-dir to HDFS but ambari has above location by default. We can follow the manual guide once enabling the labels through Ambari (Based on my testing in lab) ... View more

Set enable.doAs to "False"...This is really good explanation Link When set to "false," the Hive user identity is used instead of the individual user identities for YARN. This setting enhances security and reuse: hive.server2.enable.doAs=false Note When doAs is set to false, queries execute as the Hive user and not the end user. When multiple queries run as the Hive user, they can share resources. Otherwise, YARN does not allow resources to be shared across different users. When the Hive user executes all of the queries, a Tez session opened for one query and is holding onto resources can use those resources for the next query without re-allocation. ... View more