We have a need to serve our Namenode UI through a proxy and prevent direct access to the UI.   There seems to be 2 ways we could do that but I'm having difficulty in implementing. 1.  Set dfs.namenode.http-address to 127.0.0.1 :9870   Unfortunately, it appears that cloudera's implementation does not allow an address in dfs.namenode.http-address, but instead only accept a port number.  This is then combined with the namenode hostname to build the http address.   I attempted to override via a safety valve configuration but that appears to be intercepted as well. 2.   Configure the jetty-web.xml with an IPAccessHandler that only allows connections from the local server.   I'm having difficulty finding where in the filesystem I'd set this so that cdh6 will pick this up for the namenode role. This is  Cloudera Enterprise 6.3.3 on Centos 7 ... View more