Sorry for the confusion. Let me backtrack a bit. You can Have multiple Hive services in the same cluster and you can enable TLS for one of them. You're right, though, that they are not allowed to share the same Hive Warehouse directory in HDFS, but they can use the same metastore database. You'd also have to make sure you don't collocate them on the same hosts, or you'd have to be very careful with port numbers, log directories, etc... This is not a usual configuration we find in the field or have tested extensively. So, it's not something we usually recommend and you may end up running into edge cases we don't know about. Also, when you're securing a cluster you usually don't want to leave unsecured "backdoors" that might compromise your security. Are there any specific reason you need the insecure HS2 endpoint? A new hive instance if pointed to the same backend database(of an existing Hive service), will it overwrite any tables that already exist there? (Since when a new instance is spun it creates tables under selected DB.) It will not overwrite the database. I only creates the schema if it already doesn't exist. A new instance when spun requires to have default hive location mentioned in hdfs, and can't use existing Hive's default locaiton /user/hive/warehouse and has to be something else. You're right. Both services can see and access tables created anywhere but the tables created through a specific service will be located within the warehouse dir of that service, *if* you don't specify an explicit location (external table). A new instance of hive in parallel with existing Hive service can't use Sentry, sentry supports use of only single hive service. Mmm... this is where things start to get fuzzy. But I believe this should be possible (I haven't tested). The dependency between those services is set at the Hive service side; you configure Hive to point to a Sentry instance. So, in theory, I believe that it should be possible to configure two Hive services to point to the same Sentry service: HiveA -> Sentry <- HiveB. Again, this is not a well tested path. Tread carefully 😉 (...) maybe more scenarios that i didn't already found or come across are blocking me from going ahead with this setup This is a real concern, as I mentioned above. This type of setup opens a security hole and is not something we usually recommend or see in the field. Do you have a way to bypass all of this such that both hive services are identical (Except encryption status). I'm not recommending this, but you could put a proxy in front of your HS2 service and terminate the SSL connection at the proxy, so that the clients could connect to the proxy without using TLS. Again, this would defeat the purpose of your security implementation. HTH, André
... View more
