Special Requirements for High Availability Environments
In a High Availability (HA) environment, the primary and secondary NameNodes must be configured as described in the HDP System Administration Guide.
To enable Ranger in the HDFS HA environment, the HDFS plugin must be set up in each NameNode, and then pointed to the same HDFS service set up in the Security Manager. Any policies created within that HDFS service are automatically synchronized to the primary and secondary NameNodes through the installed Apache Ranger plugin. That way, if the primary NameNode fails, the secondary NameNode takes over and the Ranger plugin at that NameNode begins to enforce the same policies for access control.
When creating the service, you must include the
and it must be set to the full host name of the primary NameNode. If the primary NameNode
fails during policy creation, you can then temporarily use the
of the secondary NameNode in the service details to enable directory lookup for policy
If, while the primary NameNode is down, you wish to create new policies, there is a slight difference in user experience when specifying the resource path. If everything is normal, this is a drop-down menu with selectable paths; however, if your cluster is running from the failover node, there will be no drop-down menu, and you will need to manually enter the path.
Primary NameNode failure does not affect the actual policy enforcement. In this setup for HA, access control is enforced during primary NameNode failure by the Ranger plugs at the secondary NameNodes.
cd /etc/ranger/admin ln -s /etc/hadoop/conf/hdfs-site.xml hdfs-site.xml ln -s /etc/hbase/conf/hbase-site.xml hbase-site.xml