hello @pphot    You can migrate HMS and HS2 instances to any other hosts. So you can add another hosts for HS2 and HMS instance and remove the previous ones once the new ones are added and are functioning normally.   For backend database, if you migrate then you have to update the configuration in the CM so that HMS has the updated information and access as to which host it needs to communicate in order to access its backend DB. Please note this is mandatory as Hive has all the information stored in its backend DB.   Let me know if the above helps.   Regards, Tushar ... View more

IIRC, The ImpalaD process runs as the "impala".   If you have sentry grants that enable access to roles the user is in any HDFL ACLs to the contrary will be ignored.   The proper way to do this is to use Sentry to grant access to the roles which map to  groups and users, you want to have access and then enable HDFS ACLs to sync the HDFS access. ... View more

Thank you for your reply Tim.   Just to clarify, security-wise, are we better off with our current configuration (default), with sentry service disabled, or with sentry enabled in testing mode?   You mentioned that sentry in testing mode does not authenticate the clients, but in the documentation it is mentioned that testing mode uses weaker authentication mechanisms.   We need this in order to prevent our analysts from doing accidental writes, drops, etc. on the data.   Our cluster is in a secure isolated environment.     ... View more