Special Requirements for High Availability Environments
In a High Availability (HA) environment, the primary and secondary NameNodes must be configured as described in the HDP System Administration Guide.
To enable Ranger in the HDFS HA environment, the HDFS plugin must be set up in each NameNode, and then pointed to the same HDFS service set up in the Security Manager. Any policies created within that HDFS service are automatically synchronized to the primary and secondary NameNodes through the installed Apache Ranger plugin. That way, if the primary NameNode fails, the secondary NameNode takes over and the Ranger plugin at that NameNode begins to enforce the same policies for access control.
When creating the service, you must include the fs.default.name
property, and it must be set to the full host name of the primary NameNode. If the primary
NameNode fails during policy creation, you can then temporarily use the
fs.default.name
of the secondary NameNode in the service details to enable
directory lookup for policy creation.
If, while the primary NameNode is down, you wish to create new policies, there is a slight difference in user experience when specifying the resource path. If everything is normal, this is a drop-down menu with selectable paths; however, if your cluster is running from the failover node, there will be no drop-down menu, and you will need to manually enter the path.
Primary NameNode failure does not affect the actual policy enforcement. In this setup for HA, access control is enforced during primary NameNode failure by the Ranger plugs at the secondary NameNodes.
For /etc/ranger/admin
,
create a symbolic link between hbase-site.xml
and
hdfs-site.xml
:
cd /etc/ranger/admin ln -s /etc/hadoop/conf/hdfs-site.xml hdfs-site.xml ln -s /etc/hbase/conf/hbase-site.xml hbase-site.xml