Knox was designed for perimeter security and having it outside the firewall allows you to lock down your data/control nodes as stated. This approach makes it easy to hide hosts/ports that may change and provides users with one main access pattern. As mentioned in the other reply your firewall policy needs to account for the hosts/ports used. This is something we have deloyed on our edge node along with Hue and other UI services and fronted with a load balancer for high availability. ... View more

Right, I was more worried about future cluster changes through Ambari or if you regenerate keytabs through Ambari. Guessing in some scenarios that would overwrite your manual updates after you have it working. I will have to review jira to see if there is anything out there to address that. ... View more

@Saumil Mayani Have you run into issues with Ambari managing your keytabs, with the manual spnego changes above? ... View more

The hue proxy hosts/groups can easily be managed with Ambari, you will need to add properties within the HDFS, Oozie and Hive service configurations and then ensure those are pushed out to your hosts. ... View more