Create local directories that are similar to those set up for the yarn.nodemanager.local-dirs property:

mkdir -p /grid/0/hadoop/llap/local
chown -R hive /grid/0/hadoop/llap

On the "setup" node, ensure that user hive has access to its HDFS home directory:

hadoop fs -mkdir -p /user/hive
hadoop fs -chown -R hive /user/hive r

Create the Certificate Authority (CA).

Create the certificate.

On the "setup" node, create the keystore parameters. In the following example, llap00 is the password specified for the new keystore:

hostname -f > /tmp/keyinput
hostname -d >> /tmp/keyinput
cat >> /tmp/keyinput << EOF
Example Corp
Palo Alto
CA
US
yes
llap00
llap00
EOF

Generate a keystore, a certificate request, and a certificate, and then import the certificate into the keystore:

cat /tmp/keyinput | keytool -genkey -alias hive -keyalg RSA -keystore \
  /etc/security/certs/keystore.jks -keysize 4096 -validity 36525 -storepass llap00
keytool -certreq -alias hive -keystore /etc/security/certs/keystore.jks \
  -storepass llap00 -file /etc/security/certs/server.csr
openssl x509 -req -days 36525 -in /etc/security/certs/server.csr \
 -CA /etc/security/certs/ca.crt -CAkey /etc/security/certs/ca.key \
 -CAserial /etc/security/certs/ca.ser -out /etc/security/certs/server.crt
keytool -import -alias hive -keystore /etc/security/certs/keystore.jks \
  -storepass llap00 -trustcacerts -file /etc/security/certs/server.crt
chown hive:hadoop /etc/security/certs/keystore.jks /etc/security/certs/server.crt
chmod 640 /etc/security/certs/keystore.jks /etc/security/certs/server.crt
rm /tmp/keyinput

Distribute the keystore and certificate to each node:

Configure LLAP and generate the package.

Specify the following properties in the /etc/hive/conf/hive-site.xml file:

Following is an example of these properties set in the llap-daemon-site.xml file:

<property>
     <name>hive.llap.daemon.work.dirs</name>
     <value>/grid/0/hadoop/llap/local</value>
</property>

<property>
     <name>hive.llap.daemon.keytab.file</name>
     <value>/etc/security/keytabs/hive.keytab</value>
</property>

<property>
     <name>hive.llap.daemon.service.principal</name>
     <value>hive/_HOST@EXAMPLE.COM</value>
</property>

<property>
     <name>hive.llap.daemon.service.ssl</name>
     <value>true</value>
</property>

<property>
     <name>hive.llap.zk.sm.principal</name>
     <value>hive@EXAMPLE.COM</value>
</property>

<property>
     <name>hive.llap.zk.sm.keytab.file</name>
     <value>>/etc/security/keytabs/hive.keytab</value>
</property>

<property>
     <name>hive.llap.zk.sm.connectionString</name>
     <value>127.0.0.1:2181,128.0.0.1:2181,129.0.0.1:2181</value>
</property>

<property>
     <name>hadoop.security.authentication</name>
     <value>kerberos</value>
</property>

<property>
     <name>hadoop.security.authorization</name>
     <value>true</value>
</property>

Optionally, you can also use hive.llap.daemon.acl and hive.llap.management.acl to restrict access to the LLAP daemon protocols.

The Hive user must have access to both.

Specify the following properties in the ssl-server.xml file.

Ensure that you perform this step before you create the LLAP package.

Following is an example of these properties set in the ssl-server.xml file:

<property>
     <name>ssl.server.truststore.location</name>
     <value>/jre/lib/security/cacerts</value>
</property>

<property>
     <name>ssl.server.keystore.location</name>
     <value>/etc/security/certs/keystore.jks</value>
</property>

<property>
     <name>ssl.server.truststore.password</name>
     <value>strong_password</value>
     </property>

<property>
     <name>ssl.server.keystore.password</name>
     <value>llap00</value>
</property>

<property>
     <name>ssl.server.keystore.keypassword</name>
     <value>llap00</value>
</property>

Generate the LLAP package.

Important

Ensure that JAVA_HOME and HADOOP_HOME are set before generating the package. JAVA_HOME and the site.global.library_path property in the appConfig.json configuration file are set using JAVA_HOME and HADOOP_HOME. If you see problems such as a missing native library, check the appConfig.json configuration file. Make sure that LLAP package generation is done under user hive because some HDFS paths in the configuration are user-specific. You can modify the paths after package generation.

To generate the LLAP package, run the following command, setting parameters as described in the LLAP Package Parameters table:

hive --service llap --name <llap_svc_name> --instances <number_of_cluster_nodes>
--cache <cache_size>m --xmx <heap_size>m --size ((<cache_size>+<heap_size>)*1.05)m
--executors <number_of_cores> --loglevel <WARN|INFO>
--args " -XX:+UseG1GC -XX:+ResizeTLAB -XX:+UseNUMA  -XX:-ResizePLAB"

Set the --loglevel parameter to INFO when you are troubleshooting or testing. The INFO option provides verbose output. In a production environment, set the --loglevel parameter to WARN, which only outputs a message to the logs if there is a warning or error. This makes the logs easier to read and reduces load on the node.

	Note
	The recommended values listed in the LLAP Package Parameters table represent a sample configuration. LLAP also can be configured to use a fraction of node resources.

Specify the keytab settings in the slider-appmaster section of the appConfig.json configuration file if they have not already been specified:

"components": {
    "slider-appmaster": {
… existing settings …
"slider.hdfs.keytab.dir": ".slider/keytabs/llap",
"slider.am.login.keytab.name": "hive.headless.keytab",
"slider.keytab.principal.name": "hive@EXAMPLE.COM"