Configuring HBase on YARN on Secure Clusters
As previously mentioned, the HBase-on-Slider application package includes both
non-secure (appConfig-default.json
) and secure
(appConfig-secured-default.json
) versions of the application
specification.
On secure clusters, you should use the secure version of the application specification.
The security-related entries in the appConfig-secured.json
file are
listed below. You will need to replace the values labeled "TODO" with the security
settings for the cluster.
"site.hbase-site.hbase.coprocessor.master.classes": "org.apache.hadoop.hbase.security.access.AccessController", "site.hbase-site.hbase.coprocessor.region.classes" : "org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController", "site.hbase-site.hbase.regionserver.kerberos.principal": "${TODO-RS-PRINCIPAL}", "site.hbase-site.hbase.regionserver.keytab.file": "${TODO-RS-KEYTAB}", "site.hbase-site.hbase.master.kerberos.principal": "${TODO-MASTER-PRINCIPAL}", "site.hbase-site.hbase.master.keytab.file": "${TODO-MASTER-KEYTAB}", "site.hbase-site.hbase.rest.authentication.kerberos.keytab" : "${TODO-REST-AUTH-KEYTAB}", "site.hbase-site.hbase.rest.kerberos.principal" : "${TODO-REST-PRINCIPAL}", "site.hbase-site.hbase.rest.keytab.file" : "${TODO-REST-KEYTAB}", "site.hbase-site.hbase.thrift.keytab.file" : "${TODO-THRIFT-KEYTAB}", "site.hbase-site.hbase.thrift.kerberos.principal" : "${TODO-THRIFT-PRINCIPAL}", "site.hdfs-site.dfs.namenode.kerberos.principal": "${TODO-NN-PRINCIPAL}", "site.hdfs-site.dfs.namenode.kerberos.internal.spnego.principal": "${TODO-NN-SPNEGO-PRINCIPAL}", "site.hdfs-site.dfs.secondary.namenode.kerberos.principal": "${TODO-SNN-PRINCIPAL}", "site.hdfs-site.dfs.secondary.namenode.kerberos.internal.spnego.principal": "${TODO-SNN-SPNEGO-PRINCIPAL}", "site.hdfs-site.dfs.datanode.kerberos.principal": "${TODO-DN-PRINCIPAL}", Note: rest and thrift components are included above. The values in curly braces need to be filled out. In components section: "slider-appmaster": { "jvm.heapsize": "256M", "slider.am.keytab.local.path": "${TODO-HEADLESS-KEYTAB}", "slider.keytab.principal.name": "${TODO-HEADLESS-PRINCIPAL}" },
Note | |
---|---|
For more information on configuring HBase-on-Slider on secure clusters, including information about keytab-associated properties and the available keytab distribution options, see Apache Slider Security. |