Thanks @Artem Ervit. I had finally found a way how to make it puppet-friendly. There are two groups of parameters that should be considered. Unfortunately not all of them are described in documentation, so had to look here(https://github.com/apache/ambari/blob/trunk/ambari-server/src/main/java/org/apache/ambari/server/configuration/Configuration.java) and here (https://github.com/apache/ambari/blob/trunk/ambari-server/src/main/python/ambari_server/setupSecurity.py). Also some hints can be found here https://cwiki.apache.org/confluence/display/AMBARI/Enable+HTTPS+and+LDAPS+together. 1) HTTPS itself: api.ssl=true
client.api.ssl.cert_name=localhost.crt
client.api.ssl.key_name=localhost.key
client.api.ssl.port=8443
client.api.ssl.keystore_name=https.keystore.p12
client.api.ssl.keystore_type=pkcs12
client.api.ssl.crt_pass=hadoop
client.api.ssl.cert_pass_file=localhost.pass.txt
security.server.keys_dir=/etc/ambari-server/certs/
2) trusted store: ssl.trustStore.password=hadoop
ssl.trustStore.path=/etc/ambari-server/certs/localhost.truststore.jks
ssl.trustStore.type=jks
If the configuration is done after the ambari-server is configured, then the ambari-server should be restarted. If it is done before, then just normally run ambari-server setup. Notes: 1) No need to change trusted store if host is using some external CA. For instance, letsencrypt. It is already supported in latest versions of java. 2) Option "client.api.ssl.crt_pass" had not been working for me, but "client.api.ssl.cert_pass_file" was ok. 3) The keystore and truststore use different formats, because keytool does not support direct creation of keystore in jks format. Only via import of jks. I was more interested in setting puppet environment. However for setup without "ambari-server setup-security" call one can use following steps: mkdir /etc/ambari-server/certs
cd /etc/ambari-server/certs/
export AMBARI_SERVER_HOSTNAME=localhost
export AMBARI_CERT_PASS=hadoop
----- HTTPS
openssl genrsa -passout pass:$AMBARI_CERT_PASS -out $AMBARI_SERVER_HOSTNAME.key 2048
openssl req -new -key $AMBARI_SERVER_HOSTNAME.key -out $AMBARI_SERVER_HOSTNAME.csr -subj "/C=IN/ST=One/L=Two/O=hwx/CN=$AMBARI_SERVER_HOSTNAME"
openssl x509 -req -days 365 -in $AMBARI_SERVER_HOSTNAME.csr -signkey $AMBARI_SERVER_HOSTNAME.key -out $AMBARI_SERVER_HOSTNAME.crt
openssl pkcs12 -export -in $AMBARI_SERVER_HOSTNAME.crt -inkey $AMBARI_SERVER_HOSTNAME.key -certfile $AMBARI_SERVER_HOSTNAME.crt -out $AMBARI_SERVER_HOSTNAME.keystore.p12 -password pass:$AMBARI_CERT_PASS
echo "$AMBARI_CERT_PASS" > $AMBARI_SERVER_HOSTNAME.pass.txt
------ Services
keytool -trustcacerts -import -file $AMBARI_SERVER_HOSTNAME.crt -alias ambari-server -keystore $AMBARI_SERVER_HOSTNAME.truststore.jks and add following lines in ambari.properties: api.ssl=true
client.api.ssl.cert_name=localhost.crt
client.api.ssl.key_name=localhost.key
client.api.ssl.port=8443
client.api.ssl.keystore_name=localhost.keystore.p12
client.api.ssl.keystore_type=pkcs12
client.api.ssl.crt_pass=hadoop
client.api.ssl.cert_pass_file=localhost.pass.txt
security.server.keys_dir=/etc/ambari-server/certs/
ssl.trustStore.password=hadoop
ssl.trustStore.path=/etc/ambari-server/certs/localhost.truststore.jks
ssl.trustStore.type=jks
... View more
