ReferencePDF version

Knox Properties in Cloudera Runtime 7.0.x

Role groups:

Categories:

Display Name Description Related Name Default Value API Name Required
Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml For advanced use only. A string to be inserted into conf/gateway-site.xml for this role only. conf/gateway-site.xml_role_safety_valve false
Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-audit.xml For advanced use only. A string to be inserted into conf/ranger-knox-audit.xml for this role only. conf/ranger-knox-audit.xml_role_safety_valve false
Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-policymgr-ssl.xml For advanced use only. A string to be inserted into conf/ranger-knox-policymgr-ssl.xml for this role only. conf/ranger-knox-policymgr-ssl.xml_role_safety_valve false
Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-security.xml For advanced use only. A string to be inserted into conf/ranger-knox-security.xml for this role only. conf/ranger-knox-security.xml_role_safety_valve false
Knox Gateway Environment Advanced Configuration Snippet (Safety Valve) For advanced use only, key-value pairs (one on each line) to be inserted into a role's environment. Applies to configurations of this role except client configuration. KNOX_GATEWAY_role_env_safety_valve false
Knox Gateway Logging Advanced Configuration Snippet (Safety Valve) For advanced use only, a string to be inserted into log4j.properties for this role only. log4j_safety_valve false
Heap Dump Directory Path to directory where heap dumps are generated when java.lang.OutOfMemoryError error is thrown. This directory is automatically created if it does not exist. If this directory already exists, role user must have write access to this directory. If this directory is shared among multiple roles, it should have 1777 permissions. The heap dump files are created with 600 permissions and are owned by the role user. The amount of free space in this directory should be greater than the maximum Java Process heap size configured for this role. oom_heap_dump_dir /tmp oom_heap_dump_dir false
Dump Heap When Out of Memory When set, generates heap dump file when java.lang.OutOfMemoryError is thrown. true oom_heap_dump_enabled true
Kill When Out of Memory When set, a SIGKILL signal is sent to the role process when java.lang.OutOfMemoryError is thrown. true oom_sigkill_enabled true
Automatically Restart Process When set, this role's process is automatically (and transparently) restarted in the event of an unexpected failure. false process_auto_restart true
Enable Metric Collection Cloudera Manager agent monitors each service and each of its role by publishing metrics to the Cloudera Manager Service Monitor. Setting it to false will stop Cloudera Manager agent from publishing any metric for corresponding service/roles. This is usually helpful for services that generate large amount of metrics which Service Monitor is not able to process. true process_should_monitor true
Display Name Description Related Name Default Value API Name Required
Knox Gateway Log Directory The log directory for log files of the role Knox Gateway. log_dir /var/log/knox/gateway log_dir false
Knox Gateway Logging Threshold The minimum log level for Knox Gateway logs INFO log_threshold false
Knox Gateway Maximum Log File Backups The maximum number of rolled log files to keep for Knox Gateway logs. Typically used by log4j or logback. 10 max_log_backup_index false
Knox Gateway Max Log Size The maximum size, in megabytes, per log file for Knox Gateway logs. Typically used by log4j or logback. 200 MiB max_log_size false
Display Name Description Related Name Default Value API Name Required
Enable Health Alerts for this Role When set, Cloudera Manager will send alerts when the health of this role reaches the threshold specified by the EventServer setting eventserver_health_events_alert_threshold true enable_alerts false
Enable Configuration Change Alerts When set, Cloudera Manager will send alerts when this entity's configuration changes. false enable_config_alerts false
File Descriptor Monitoring Thresholds The health test thresholds of the number of file descriptors used. Specified as a percentage of file descriptor limit. Warning: 50.0 %, Critical: 70.0 % knox_gateway_fd_thresholds false
Knox Gateway Host Health Test When computing the overall Knox Gateway health, consider the host's health. true knox_gateway_host_health_enabled false
Knox Gateway Process Health Test Enables the health test that the Knox Gateway's process state is consistent with the role configuration true knox_gateway_scm_health_enabled false
Log Directory Free Space Monitoring Absolute Thresholds The health test thresholds for monitoring of free space on the filesystem that contains this role's log directory. Warning: 10 GiB, Critical: 5 GiB log_directory_free_space_absolute_thresholds false
Log Directory Free Space Monitoring Percentage Thresholds The health test thresholds for monitoring of free space on the filesystem that contains this role's log directory. Specified as a percentage of the capacity on that filesystem. This setting is not used if a Log Directory Free Space Monitoring Absolute Thresholds setting is configured. Warning: Never, Critical: Never log_directory_free_space_percentage_thresholds false
Process Swap Memory Thresholds The health test thresholds on the swap memory usage of the process. This takes precedence over the host level threshold. Warning: 200 B, Critical: Never process_swap_memory_thresholds false
Role Triggers The configured triggers for this role. This is a JSON-formatted list of triggers. These triggers are evaluated as part as the health system. Every trigger expression is parsed, and if the trigger condition is met, the list of actions provided in the trigger expression is executed. Each trigger has the following fields:
  • triggerName (mandatory) - The name of the trigger. This value must be unique for the specific role.
  • triggerExpression (mandatory) - A tsquery expression representing the trigger.
  • streamThreshold (optional) - The maximum number of streams that can satisfy a condition of a trigger before the condition fires. By default set to 0, and any stream returned causes the condition to fire.
  • enabled (optional) - By default set to 'true'. If set to 'false', the trigger is not evaluated.
  • expressionEditorConfig (optional) - Metadata for the trigger editor. If present, the trigger should only be edited from the Edit Trigger page; editing the trigger here can lead to inconsistencies.
For example, the following JSON formatted trigger configured for a DataNode fires if the DataNode has more than 1500 file descriptors opened:[{"triggerName": "sample-trigger", "triggerExpression": "IF (SELECT fd_open WHERE roleName=$ROLENAME and last(fd_open) > 1500) DO health:bad", "streamThreshold": 0, "enabled": "true"}]See the trigger rules documentation for more details on how to write triggers using tsquery.The JSON format is evolving and may change and, as a result, backward compatibility is not guaranteed between releases.		 [] role_triggers true
Unexpected Exits Thresholds The health test thresholds for unexpected exits encountered within a recent period specified by the unexpected_exits_window configuration for the role. Warning: Never, Critical: Any unexpected_exits_thresholds false
Unexpected Exits Monitoring Period The period to review when computing unexpected exits. 5 minute(s) unexpected_exits_window false
Display Name Description Related Name Default Value API Name Required
Knox Gateway Diagnostics Collection Timeout The timeout in milliseconds to wait for diagnostics collection to complete. 5 minute(s) csd_role_diagnostics_timeout false
Auto Discovery - Address The URL which Knox's service auto-discovery feature uses to connect to gateway.auto.discovery.address gateway_auto_discovery_address false
Auto Discovery - Cluster The cluster where you would like Knox activates the auto-discovery feature gateway.auto.discovery.cluster gateway_auto_discovery_cluster false
Enable/Disable Service Auto-Discovery Whether Knox's service auto-discovery feature is enabled gateway.auto.discovery.enabled false gateway_auto_discovery_enabled false
Auto Discovery - Password The password which Knox's service auto-discovery feature uses to connect to CM gateway.auto.discovery.password gateway_auto_discovery_password false
Auto Discovery - Services The list of services which Knox's auto-discovery feature should monitor gateway_auto_discovery_services ATLAS ATLAS-API CM-API CM-UI HBASEUI HDFSUI HUE JOBHISTORYUI LIVYSERVER NAMENODE OOZIE OOZIEUI RANGER RANGERUI RESOURCEMANAGER SOLR SPARKHISTORYUI WEBHDFS YARNUI YARNUIV2 ZEPPELINUI ZEPPELINWS gateway_auto_discovery_services false
Auto Discovery - User The user name which Knox's service auto-discovery feature uses to connect to CM gateway.auto.discovery.user admin gateway_auto_discovery_user false
Knox Gateway Configuration Directory Contains configuration files that apply to the gateway globally (i.e. not cluster specific ). gateway_conf_dir /var/lib/knox/gateway/conf gateway_conf_dir false
Knox Gateway Data Directory Contains security and topology specific artifacts as well as important applications for admin-ui gateway_data_dir /var/lib/knox/gateway/data gateway_data_dir false
Gateway - Default App Topology Name When a topology file is deployed with a file name that matches the configured default topology name, a specialized mapping for URLs is installed for that particular topology. This allows the URLs that are expected by the existing Hadoop CLIs for WebHDFS to be used in interacting with the specific Hadoop cluster that is represented by the default topology file. default.app.topology.name gateway_default_topology_name false
Knox Gateway Dispatch Whitelist The whitelist to be applied for dispatches associated with the service roles specified by gateway.dispatch.whitelist.services. If the value is DEFAULT, a domain-based whitelist will be derived from the Knox host. gateway.dispatch.whitelist DEFAULT gateway_dispatch_whitelist false
Knox Gateway Dispatch Whitelist Services The comma-delimited list of service roles for which the 'gateway.dispatch.whitelist' should be applied gateway.dispatch.whitelist.services DATANODE, HBASEUI, HDFSUI, JOBHISTORYUI, NODEUI, YARNUI, knoxauth gateway_dispatch_whitelist_services false
Gateway Config Directory The directory within 'gateway_data_dir' that contains gateway topology files and deployments. gateway.gateway.conf.dir deployments gateway_gateway_conf_dir false
Additional Gateway Java Options These arguments are passed as part of the Java command line. Commonly, garbage collection flags or extra debugging flags are passed here. gateway_java_opts gateway_java_opts false
Admin Groups Admin groups for Knox gateway.knox.admin.groups admin gateway_knox_admin_groups false
Knox Gateway Log Level The logging level of Knox Gateway gateway_log_level ERROR gateway_log_level false
Knox Master Secret The master secret is used to access secured artifacts by the gateway instance. Keystore, trust stores and credential stores are all protected with the master secret. NOTE: changing the master secret will require you to change passwords protecting the keystores for the gateway, identity keystores and all credential stores gateway_master_secret gateway_master_secret true
Gateway Path The default context path for the gateway. gateway.path gateway gateway_path true
Ranger Knox Plugin Conf Path Staging directory for Ranger Knox Plugin Configuration. This should generally not be changed. gateway_ranger_knox_plugin_conf_path /var/lib/knox/ranger-knox-plugin gateway_ranger_knox_plugin_conf_path true
Ranger Knox Plugin Audit Hdfs Spool Directory Path Spool directory for Ranger audits being written to DFS. xasecure.audit.destination.hdfs.batch.filespool.dir /var/log/knox/gateway/audit/hdfs/spool gateway_ranger_knox_plugin_hdfs_audit_spool_directory true
Ranger Knox Plugin Policy Cache Directory Path The directory where Ranger security policies are cached locally. ranger.plugin.knox.policy.cache.dir /var/lib/ranger/knox/gateway/policy-cache gateway_ranger_knox_plugin_policy_cache_directory true
Ranger Knox Plugin Audit Solr Spool Directory Path Spool directory for Ranger audits being written to Solr. xasecure.audit.destination.solr.batch.filespool.dir /var/log/knox/gateway/audit/solr/spool gateway_ranger_knox_plugin_solr_audit_spool_directory true
Cookie Scoping Enabled Enable/Disable cookie scoping feature. gateway.scope.cookies.feature.enabled false gateway_scope_cookies_feature_enabled false
Security - Signing Key Alias The alias for the signing keypair within the keystore specified via gateway_signing_keystore_name gateway.signing.key.alias gateway_signing_key_alias false
Security - Signing Keystore Name The filename of keystore file that contains the signing keypair gateway.signing.keystore.name gateway_signing_keystore_name false
Security - Signing Keystore Type The type of the keystore file where the signing keypair is stored. See gateway_signing_keystore_name gateway.signing.keystore.type gateway_signing_keystore_type false
Websockets Enabled Enable/Disable websocket feature. gateway.websocket.feature.enabled true gateway_websocket_feature_enabled false
X-Forwarded Header Context Service Name The service name to be added in x-forward-context header. gateway.xforwarded.header.context.append.servicename LIVYSERVER gateway_xforwarded_header_context_append_servicename false
Admin Group Mapping - Class Name The class name used for Hadoop admin group mapping gateway.group.config.hadoop.security.group.mapping org.apache.hadoop.security.ShellBasedUnixGroupsMapping hadoop_security_group_mapping_class false
krb5.conf Location Absolute path to krb5.conf file java.security.krb5.conf /etc/krb5.conf java_security_krb5_conf false
KRB5 Debug Boolean flag indicating whether to enable debug messages for krb5 authentication sun.security.krb5.debug false sun_security_krb5_debug false
Display Name Description Related Name Default Value API Name Required
Maximum Process File Descriptors If configured, overrides the process soft and hard rlimits (also called ulimits) for file descriptors to the configured value. rlimit_fds false
Display Name Description Related Name Default Value API Name Required
Gateway HTTP Port The HTTP port for the Gateway. gateway.port 8443 gateway_port true
Display Name Description Related Name Default Value API Name Required
Cgroup CPU Shares Number of CPU shares to assign to this role. The greater the number of shares, the larger the share of the host's CPUs that will be given to this role when the host experiences CPU contention. Must be between 2 and 262144. Defaults to 1024 for processes not managed by Cloudera Manager. cpu.shares 1024 rm_cpu_shares true
Cgroup I/O Weight Weight for the read I/O requests issued by this role. The greater the weight, the higher the priority of the requests when the host experiences I/O contention. Must be between 100 and 1000. Defaults to 1000 for processes not managed by Cloudera Manager. blkio.weight 500 rm_io_weight true
Cgroup Memory Hard Limit Hard memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 to specify no limit. By default processes not managed by Cloudera Manager will have no limit. If the value is -1, Cloudera Manager will not monitor Cgroup memory usage therefore some of the charts will show 'No Data' memory.limit_in_bytes -1 MiB rm_memory_hard_limit true
Cgroup Memory Soft Limit Soft memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process if and only if the host is facing memory pressure. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 to specify no limit. By default processes not managed by Cloudera Manager will have no limit. If the value is -1, Cloudera Manager will not monitor Cgroup memory usage therefore some of the charts will show 'No Data' memory.soft_limit_in_bytes -1 MiB rm_memory_soft_limit true
Display Name Description Related Name Default Value API Name Required
Knox Gateway TLS/SSL Client Trust Store File The location on disk of the trust store, in .jks format, used to confirm the authenticity of TLS/SSL servers that Knox Gateway might connect to. This is used when Knox Gateway is the client in a TLS/SSL connection. This trust store must contain the certificate(s) used to sign the service(s) connected to. If this parameter is not provided, the default list of well-known certificate authorities is used instead. gateway.httpclient.truststore.path ssl_client_truststore_location false
Knox Gateway TLS/SSL Client Trust Store Password The password for the Knox Gateway TLS/SSL Certificate Trust Store File. This password is not required to access the trust store; this field can be left blank. This password provides optional integrity checking of the file. The contents of trust stores are certificates, and certificates are public information. ssl_client_truststore_password false
Enable TLS/SSL for Knox Gateway Encrypt communication between clients and Knox Gateway using Transport Layer Security (TLS) (formerly known as Secure Socket Layer (SSL)). false ssl_enabled false
Knox Gateway TLS/SSL Server JKS Keystore File Location The path to the TLS/SSL keystore file containing the server certificate and private key used for TLS/SSL. Used when Knox Gateway is acting as a TLS/SSL server. The keystore must be in JKS format. gateway.tls.keystore.path ssl_server_keystore_location false
Knox Gateway TLS/SSL Server JKS Keystore File Password The password for the Knox Gateway JKS keystore file. ssl_server_keystore_password false
Display Name Description Related Name Default Value API Name Required
Stacks Collection Data Retention The amount of stacks data that is retained. After the retention limit is reached, the oldest data is deleted. stacks_collection_data_retention 100 MiB stacks_collection_data_retention false
Stacks Collection Directory The directory in which stacks logs are placed. If not set, stacks are logged into a stacks subdirectory of the role's log directory. stacks_collection_directory stacks_collection_directory false
Stacks Collection Enabled Whether or not periodic stacks collection is enabled. stacks_collection_enabled false stacks_collection_enabled true
Stacks Collection Frequency The frequency with which stacks are collected. stacks_collection_frequency 5.0 second(s) stacks_collection_frequency false
Stacks Collection Method The method used to collect stacks. The jstack option involves periodically running the jstack command against the role's daemon process. The servlet method is available for those roles that have an HTTP server endpoint exposing the current stacks traces of all threads. When the servlet method is selected, that HTTP endpoint is periodically scraped. stacks_collection_method jstack stacks_collection_method false
Display Name Description Related Name Default Value API Name Required
Suppress Configuration Validator: Version Validator Whether to suppress configuration warnings produced by the Version Validator configuration validator. false role_config_suppression_cdh_version_validator true
Suppress Parameter Validation: Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml parameter. false role_config_suppression_conf/gateway-site.xml_role_safety_valve true
Suppress Parameter Validation: Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-audit.xml Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-audit.xml parameter. false role_config_suppression_conf/ranger-knox-audit.xml_role_safety_valve true
Suppress Parameter Validation: Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-policymgr-ssl.xml Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-policymgr-ssl.xml parameter. false role_config_suppression_conf/ranger-knox-policymgr-ssl.xml_role_safety_valve true
Suppress Parameter Validation: Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-security.xml Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Advanced Configuration Snippet (Safety Valve) for conf/ranger-knox-security.xml parameter. false role_config_suppression_conf/ranger-knox-security.xml_role_safety_valve true
Suppress Parameter Validation: Auto Discovery - Address Whether to suppress configuration warnings produced by the built-in parameter validation for the Auto Discovery - Address parameter. false role_config_suppression_gateway_auto_discovery_address true
Suppress Parameter Validation: Auto Discovery - Cluster Whether to suppress configuration warnings produced by the built-in parameter validation for the Auto Discovery - Cluster parameter. false role_config_suppression_gateway_auto_discovery_cluster true
Suppress Parameter Validation: Auto Discovery - Password Whether to suppress configuration warnings produced by the built-in parameter validation for the Auto Discovery - Password parameter. false role_config_suppression_gateway_auto_discovery_password true
Suppress Parameter Validation: Auto Discovery - Services Whether to suppress configuration warnings produced by the built-in parameter validation for the Auto Discovery - Services parameter. false role_config_suppression_gateway_auto_discovery_services true
Suppress Parameter Validation: Auto Discovery - User Whether to suppress configuration warnings produced by the built-in parameter validation for the Auto Discovery - User parameter. false role_config_suppression_gateway_auto_discovery_user true
Suppress Parameter Validation: Knox Gateway Configuration Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Configuration Directory parameter. false role_config_suppression_gateway_conf_dir true
Suppress Parameter Validation: Knox Gateway Data Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Data Directory parameter. false role_config_suppression_gateway_data_dir true
Suppress Parameter Validation: Gateway - Default App Topology Name Whether to suppress configuration warnings produced by the built-in parameter validation for the Gateway - Default App Topology Name parameter. false role_config_suppression_gateway_default_topology_name true
Suppress Parameter Validation: Knox Gateway Dispatch Whitelist Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Dispatch Whitelist parameter. false role_config_suppression_gateway_dispatch_whitelist true
Suppress Parameter Validation: Knox Gateway Dispatch Whitelist Services Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Dispatch Whitelist Services parameter. false role_config_suppression_gateway_dispatch_whitelist_services true
Suppress Parameter Validation: Gateway Config Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Gateway Config Directory parameter. false role_config_suppression_gateway_gateway_conf_dir true
Suppress Parameter Validation: Additional Gateway Java Options Whether to suppress configuration warnings produced by the built-in parameter validation for the Additional Gateway Java Options parameter. false role_config_suppression_gateway_java_opts true
Suppress Parameter Validation: Admin Groups Whether to suppress configuration warnings produced by the built-in parameter validation for the Admin Groups parameter. false role_config_suppression_gateway_knox_admin_groups true
Suppress Parameter Validation: Knox Master Secret Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Master Secret parameter. false role_config_suppression_gateway_master_secret true
Suppress Parameter Validation: Gateway Path Whether to suppress configuration warnings produced by the built-in parameter validation for the Gateway Path parameter. false role_config_suppression_gateway_path true
Suppress Parameter Validation: Gateway HTTP Port Whether to suppress configuration warnings produced by the built-in parameter validation for the Gateway HTTP Port parameter. false role_config_suppression_gateway_port true
Suppress Parameter Validation: Ranger Knox Plugin Conf Path Whether to suppress configuration warnings produced by the built-in parameter validation for the Ranger Knox Plugin Conf Path parameter. false role_config_suppression_gateway_ranger_knox_plugin_conf_path true
Suppress Parameter Validation: Ranger Knox Plugin Audit Hdfs Spool Directory Path Whether to suppress configuration warnings produced by the built-in parameter validation for the Ranger Knox Plugin Audit Hdfs Spool Directory Path parameter. false role_config_suppression_gateway_ranger_knox_plugin_hdfs_audit_spool_directory true
Suppress Parameter Validation: Ranger Knox Plugin Policy Cache Directory Path Whether to suppress configuration warnings produced by the built-in parameter validation for the Ranger Knox Plugin Policy Cache Directory Path parameter. false role_config_suppression_gateway_ranger_knox_plugin_policy_cache_directory true
Suppress Parameter Validation: Ranger Knox Plugin Audit Solr Spool Directory Path Whether to suppress configuration warnings produced by the built-in parameter validation for the Ranger Knox Plugin Audit Solr Spool Directory Path parameter. false role_config_suppression_gateway_ranger_knox_plugin_solr_audit_spool_directory true
Suppress Parameter Validation: Security - Signing Key Alias Whether to suppress configuration warnings produced by the built-in parameter validation for the Security - Signing Key Alias parameter. false role_config_suppression_gateway_signing_key_alias true
Suppress Parameter Validation: Security - Signing Keystore Name Whether to suppress configuration warnings produced by the built-in parameter validation for the Security - Signing Keystore Name parameter. false role_config_suppression_gateway_signing_keystore_name true
Suppress Parameter Validation: Security - Signing Keystore Type Whether to suppress configuration warnings produced by the built-in parameter validation for the Security - Signing Keystore Type parameter. false role_config_suppression_gateway_signing_keystore_type true
Suppress Parameter Validation: X-Forwarded Header Context Service Name Whether to suppress configuration warnings produced by the built-in parameter validation for the X-Forwarded Header Context Service Name parameter. false role_config_suppression_gateway_xforwarded_header_context_append_servicename true
Suppress Parameter Validation: Admin Group Mapping - Class Name Whether to suppress configuration warnings produced by the built-in parameter validation for the Admin Group Mapping - Class Name parameter. false role_config_suppression_hadoop_security_group_mapping_class true
Suppress Parameter Validation: krb5.conf Location Whether to suppress configuration warnings produced by the built-in parameter validation for the krb5.conf Location parameter. false role_config_suppression_java_security_krb5_conf true
Suppress Parameter Validation: Knox Gateway Environment Advanced Configuration Snippet (Safety Valve) Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Environment Advanced Configuration Snippet (Safety Valve) parameter. false role_config_suppression_knox_gateway_role_env_safety_valve true
Suppress Parameter Validation: Knox Gateway Logging Advanced Configuration Snippet (Safety Valve) Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Logging Advanced Configuration Snippet (Safety Valve) parameter. false role_config_suppression_log4j_safety_valve true
Suppress Parameter Validation: Knox Gateway Log Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway Log Directory parameter. false role_config_suppression_log_dir true
Suppress Parameter Validation: Heap Dump Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Heap Dump Directory parameter. false role_config_suppression_oom_heap_dump_dir true
Suppress Parameter Validation: Role Triggers Whether to suppress configuration warnings produced by the built-in parameter validation for the Role Triggers parameter. false role_config_suppression_role_triggers true
Suppress Parameter Validation: Knox Gateway TLS/SSL Client Trust Store File Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway TLS/SSL Client Trust Store File parameter. false role_config_suppression_ssl_client_truststore_location true
Suppress Parameter Validation: Knox Gateway TLS/SSL Client Trust Store Password Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway TLS/SSL Client Trust Store Password parameter. false role_config_suppression_ssl_client_truststore_password true
Suppress Parameter Validation: Knox Gateway TLS/SSL Server JKS Keystore File Location Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway TLS/SSL Server JKS Keystore File Location parameter. false role_config_suppression_ssl_server_keystore_location true
Suppress Parameter Validation: Knox Gateway TLS/SSL Server JKS Keystore File Password Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Gateway TLS/SSL Server JKS Keystore File Password parameter. false role_config_suppression_ssl_server_keystore_password true
Suppress Parameter Validation: Stacks Collection Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Stacks Collection Directory parameter. false role_config_suppression_stacks_collection_directory true
Suppress Health Test: Audit Pipeline Test Whether to suppress the results of the Audit Pipeline Test heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_knox_gateway_audit_health true
Suppress Health Test: File Descriptors Whether to suppress the results of the File Descriptors heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_knox_gateway_file_descriptor true
Suppress Health Test: Host Health Whether to suppress the results of the Host Health heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_knox_gateway_host_health true
Suppress Health Test: Log Directory Free Space Whether to suppress the results of the Log Directory Free Space heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_knox_gateway_log_directory_free_space true
Suppress Health Test: Process Status Whether to suppress the results of the Process Status heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_knox_gateway_scm_health true
Suppress Health Test: Swap Memory Usage Whether to suppress the results of the Swap Memory Usage heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_knox_gateway_swap_memory_usage true
Suppress Health Test: Unexpected Exits Whether to suppress the results of the Unexpected Exits heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_knox_gateway_unexpected_exits true

Categories:

Display Name Description Related Name Default Value API Name Required
Knox IDBroker Advanced Configuration Snippet (Safety Valve) for conf/gateway-reloadable.xml For advanced use only. A string to be inserted into conf/gateway-reloadable.xml for this role only. conf/gateway-reloadable.xml_role_safety_valve false
Knox IDBroker Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml For advanced use only. A string to be inserted into conf/gateway-site.xml for this role only. conf/gateway-site.xml_role_safety_valve false
Knox IDBroker Environment Advanced Configuration Snippet (Safety Valve) For advanced use only, key-value pairs (one on each line) to be inserted into a role's environment. Applies to configurations of this role except client configuration. IDBROKER_role_env_safety_valve false
Knox IDBroker Logging Advanced Configuration Snippet (Safety Valve) For advanced use only, a string to be inserted into log4j.properties for this role only. log4j_safety_valve false
Heap Dump Directory Path to directory where heap dumps are generated when java.lang.OutOfMemoryError error is thrown. This directory is automatically created if it does not exist. If this directory already exists, role user must have write access to this directory. If this directory is shared among multiple roles, it should have 1777 permissions. The heap dump files are created with 600 permissions and are owned by the role user. The amount of free space in this directory should be greater than the maximum Java Process heap size configured for this role. oom_heap_dump_dir /tmp oom_heap_dump_dir false
Dump Heap When Out of Memory When set, generates heap dump file when java.lang.OutOfMemoryError is thrown. true oom_heap_dump_enabled true
Kill When Out of Memory When set, a SIGKILL signal is sent to the role process when java.lang.OutOfMemoryError is thrown. true oom_sigkill_enabled true
Automatically Restart Process When set, this role's process is automatically (and transparently) restarted in the event of an unexpected failure. false process_auto_restart true
Enable Metric Collection Cloudera Manager agent monitors each service and each of its role by publishing metrics to the Cloudera Manager Service Monitor. Setting it to false will stop Cloudera Manager agent from publishing any metric for corresponding service/roles. This is usually helpful for services that generate large amount of metrics which Service Monitor is not able to process. true process_should_monitor true
Display Name Description Related Name Default Value API Name Required
Knox IDBroker Log Directory The log directory for log files of the role Knox IDBroker. log_dir /var/log/knox/idbroker log_dir false
Knox IDBroker Logging Threshold The minimum log level for Knox IDBroker logs INFO log_threshold false
Knox IDBroker Maximum Log File Backups The maximum number of rolled log files to keep for Knox IDBroker logs. Typically used by log4j or logback. 10 max_log_backup_index false
Knox IDBroker Max Log Size The maximum size, in megabytes, per log file for Knox IDBroker logs. Typically used by log4j or logback. 200 MiB max_log_size false
Display Name Description Related Name Default Value API Name Required
Enable Health Alerts for this Role When set, Cloudera Manager will send alerts when the health of this role reaches the threshold specified by the EventServer setting eventserver_health_events_alert_threshold true enable_alerts false
Enable Configuration Change Alerts When set, Cloudera Manager will send alerts when this entity's configuration changes. false enable_config_alerts false
File Descriptor Monitoring Thresholds The health test thresholds of the number of file descriptors used. Specified as a percentage of file descriptor limit. Warning: 50.0 %, Critical: 70.0 % idbroker_fd_thresholds false
Knox IDBroker Host Health Test When computing the overall Knox IDBroker health, consider the host's health. true idbroker_host_health_enabled false
Knox IDBroker Process Health Test Enables the health test that the Knox IDBroker's process state is consistent with the role configuration true idbroker_scm_health_enabled false
Log Directory Free Space Monitoring Absolute Thresholds The health test thresholds for monitoring of free space on the filesystem that contains this role's log directory. Warning: 10 GiB, Critical: 5 GiB log_directory_free_space_absolute_thresholds false
Log Directory Free Space Monitoring Percentage Thresholds The health test thresholds for monitoring of free space on the filesystem that contains this role's log directory. Specified as a percentage of the capacity on that filesystem. This setting is not used if a Log Directory Free Space Monitoring Absolute Thresholds setting is configured. Warning: Never, Critical: Never log_directory_free_space_percentage_thresholds false
Process Swap Memory Thresholds The health test thresholds on the swap memory usage of the process. This takes precedence over the host level threshold. Warning: 200 B, Critical: Never process_swap_memory_thresholds false
Role Triggers The configured triggers for this role. This is a JSON-formatted list of triggers. These triggers are evaluated as part as the health system. Every trigger expression is parsed, and if the trigger condition is met, the list of actions provided in the trigger expression is executed. Each trigger has the following fields:
  • triggerName (mandatory) - The name of the trigger. This value must be unique for the specific role.
  • triggerExpression (mandatory) - A tsquery expression representing the trigger.
  • streamThreshold (optional) - The maximum number of streams that can satisfy a condition of a trigger before the condition fires. By default set to 0, and any stream returned causes the condition to fire.
  • enabled (optional) - By default set to 'true'. If set to 'false', the trigger is not evaluated.
  • expressionEditorConfig (optional) - Metadata for the trigger editor. If present, the trigger should only be edited from the Edit Trigger page; editing the trigger here can lead to inconsistencies.
For example, the following JSON formatted trigger configured for a DataNode fires if the DataNode has more than 1500 file descriptors opened:[{"triggerName": "sample-trigger", "triggerExpression": "IF (SELECT fd_open WHERE roleName=$ROLENAME and last(fd_open) > 1500) DO health:bad", "streamThreshold": 0, "enabled": "true"}]See the trigger rules documentation for more details on how to write triggers using tsquery.The JSON format is evolving and may change and, as a result, backward compatibility is not guaranteed between releases.		 [] role_triggers true
Unexpected Exits Thresholds The health test thresholds for unexpected exits encountered within a recent period specified by the unexpected_exits_window configuration for the role. Warning: Never, Critical: Any unexpected_exits_thresholds false
Unexpected Exits Monitoring Period The period to review when computing unexpected exits. 5 minute(s) unexpected_exits_window false
Display Name Description Related Name Default Value API Name Required
Knox IDBroker Diagnostics Collection Timeout The timeout in milliseconds to wait for diagnostics collection to complete. 5 minute(s) csd_role_diagnostics_timeout false
Knox IDBroker AWS Credentials Key The AWS credentials key idbroker_aws_credentials_key idbroker_aws_credentials_key false
Knox IDBroker AWS Credentials Secret The AWS credentials secret idbroker_aws_credentials_secret idbroker_aws_credentials_secret false
Knox IDBroker AWS Group Mapping The list of AWS group-role mappings in 'group=role[;group=role]...[;group=role]' format. A 'group=role' declaration indicates that all authenticated users that are member of the specified group should be able to assume the specified role. For instance: admin=arn:aws:iam:XYZ:role/s3full;audit=arn:aws:iam:XYZ:role/s3Read idbroker.aws.group.role.mapping idbroker_aws_group_mapping false
Knox IDBroker AWS User Mapping The list of AWS user-role mappings in 'user=role[;user=role]...[;user=role]' format. A 'user=role' declaration indicates that this is a mapping of the authenticated user’s primary principal to the specified role. For instance: admin=arn:aws:iam:XYZ:role/s3full;guest=arn:aws:iam:XYZ:role/s3Read idbroker.aws.user.role.mapping idbroker_aws_user_mapping false
Knox IDBroker AZURE ADLS2 Tenant Name The name of the AZURE AD tenant. A tenant is a representation of an organization. It's a dedicated instance of Azure AD that an organization or application developer receives when the organization or application developer creates a relationship with Microsoft idbroker_azure_adls2_tenant_name idbroker_azure_adls2_tenant_name false
Knox IDBroker AZURE 'blob-contributor' ClientID The client ID credential for 'blob-contributor' role idbroker_azure_blob_contributor_clientid idbroker_azure_blob_contributor_clientid false
Knox IDBroker AZURE 'blob-contributor' Secret The secret credential for 'blob-contributor' role idbroker_azure_blob_contributor_secret idbroker_azure_blob_contributor_secret false
Knox IDBroker AZURE 'blob-reader' ClientID The client ID credential for 'blob-reader' role idbroker_azure_blob_reader_clientid idbroker_azure_blob_reader_clientid false
Knox IDBroker AZURE 'blob-reader' Secret The secret credential for 'blob-reader' role idbroker_azure_blob_reader_secret idbroker_azure_blob_reader_secret false
Knox IDBroker AZURE Group Mapping The list of AZURE group-role mappings in 'group=role[;group=role]...[;group=role]' format. A 'group=role' declaration indicates that all authenticated users that are member of the specified group should be able to assume the specified role. For instance: admin=blob-contributor idbroker.adls2.group.role.mapping idbroker_azure_group_mapping false
Knox IDBroker AZURE User Mapping The list of AZURE user-role mappings in 'user=role[;user=role]...[;user=role]' format. A 'user=role' declaration indicates that this is a mapping of the authenticated user’s primary principal to the specified role. For instance: admin=blob-contributor idbroker.adls2.user.role.mapping idbroker_azure_user_mapping false
Knox IDBroker Configuration Directory Contains configuration files that apply to the gateway globally (i.e. not cluster specific ). idbroker_conf_dir /var/lib/knox/idbroker/conf idbroker_conf_dir false
Knox IDBroker Data Directory Contains security and topology specific artifacts as well as important applications for admin-ui idbroker_data_dir /var/lib/knox/idbroker/data idbroker_data_dir false
Gateway Config Directory The directory within 'idbroker_data_dir' that contains gateway topology files and deployments. gateway.gateway.conf.dir deployments idbroker_gateway_gateway_conf_dir false
Admin Groups Admin groups for Knox gateway.knox.admin.groups admin idbroker_gateway_knox_admin_groups false
Gateway Path The default context path for the gateway. gateway.path gateway idbroker_gateway_path true
Cookie Scoping Enabled Enable/Disable cookie scoping feature. gateway.scope.cookies.feature.enabled false idbroker_gateway_scope_cookies_feature_enabled false
Security - Signing Key Alias The alias for the signing keypair within the keystore specified via idbroker_gateway_signing_keystore_name gateway.signing.key.alias idbroker_gateway_signing_key_alias false
Security - Signing Keystore Name The filename of keystore file that contains the signing keypair gateway.signing.keystore.name idbroker_gateway_signing_keystore_name false
Security - Signing Keystore Type The type of the keystore file where the signing keypair is stored. See idbroker_gateway_signing_keystore_name gateway.signing.keystore.type idbroker_gateway_signing_keystore_type false
Knox IDBroker GCP Credential Key The GCP Credential Key idbroker_gcp_credential_key idbroker_gcp_credential_key false
Knox IDBroker GCP Credential Secret The GCP Credential Secret idbroker_gcp_credential_secret idbroker_gcp_credential_secret false
Knox IDBroker GCP Group Mapping The list of GCP group-role mappings in 'group=role[;group=role]...[;group=role]' format. A 'group=role' declaration indicates that all authenticated users that are member of the specified group should be able to assume the specified role. For instance: admin=storage-admin@XYZ.iam.gserviceaccount.com;audit=storage-read-only@XYZ.iam.gserviceaccount.com idbroker.gcp.group.role.mapping idbroker_gcp_group_mapping false
Knox IDBroker GCP User Mapping The list of GCP user-role mappings in 'user=role[;user=role]...[;user=role]' format. A 'user=role' declaration indicates that this is a mapping of the authenticated user’s primary principal to the specified role. For instance: admin=storage-admin@XYZ.iam.gserviceaccount.com;guest=storage-read-only@XYZ.iam.gserviceaccount.com idbroker.gcp.user.role.mapping idbroker_gcp_user_mapping false
Admin Group Mapping - Class Name The class name used for Hadoop admin group mapping gateway.group.config.hadoop.security.group.mapping org.apache.hadoop.security.ShellBasedUnixGroupsMapping idbroker_hadoop_security_group_mapping_class false
Additional IDBroker Java Options These arguments are passed as part of the Java command line. Commonly, garbage collection flags or extra debugging flags are passed here. idbroker_java_opts idbroker_java_opts false
krb5.conf Location Absolute path to krb5.conf file java.security.krb5.conf /etc/krb5.conf idbroker_java_security_krb5_conf false
Kerberos Proxyuser Block Proxyuser configuration used in Knox's 'dt' topology in case Kerberos is enabled. Must conform a valid JSON key-value format! idbroker_kerberos_dt_proxyuser_block hadoop.proxyuser.livy.hosts: * hadoop.proxyuser.livy.groups: * hadoop.proxyuser.hive.hosts: * hadoop.proxyuser.hive.groups: * hadoop.proxyuser.httpfs.hosts: * hadoop.proxyuser.httpfs.groups: * hadoop.proxyuser.hue.hosts: * hadoop.proxyuser.hue.groups: * hadoop.proxyuser.oozie.hosts: * hadoop.proxyuser.oozie.groups: * idbroker_kerberos_dt_proxyuser_block false
IDBroker Knox Token TTL This indicates the lifespan of the token. Once it expires a new token must be acquired from KnoxToken service. This is in milliseconds. idbroker_knox_token_ttl_ms 7 day(s) idbroker_knox_token_ttl_ms false
Knox IDBroker Log Directory The folder where Knox IDBroker puts it's logs idbroker_log_dir /var/log/knox/idbroker idbroker_log_dir false
IDBroker Log Level The logging level of IDBroker idbroker_log_level ERROR idbroker_log_level false
IDBroker Master Secret The master secret is used to access secured artifacts by the gateway instance. Keystore, trust stores and credential stores are all protected with the master secret. NOTE: changing the master secret will require you to change passwords protecting the keystores for the gateway, identity keystores and all credential stores idbroker_master_secret idbroker_master_secret true
Gateway Config Refresh Interval Defines the frequency of gateway configuration refresh. gateway.config.refresh.interval 10 second(s) idbroker_relaodable_refresh_interval_ms false
KRB5 Debug Boolean flag indicating whether to enable debug messages for krb5 authentication sun.security.krb5.debug false idbroker_sun_security_krb5_debug false
Display Name Description Related Name Default Value API Name Required
Maximum Process File Descriptors If configured, overrides the process soft and hard rlimits (also called ulimits) for file descriptors to the configured value. rlimit_fds false
Display Name Description Related Name Default Value API Name Required
Gateway HTTP Port The HTTP port for the Gateway. gateway.port 8444 idbroker_gateway_port true
Display Name Description Related Name Default Value API Name Required
Cgroup CPU Shares Number of CPU shares to assign to this role. The greater the number of shares, the larger the share of the host's CPUs that will be given to this role when the host experiences CPU contention. Must be between 2 and 262144. Defaults to 1024 for processes not managed by Cloudera Manager. cpu.shares 1024 rm_cpu_shares true
Cgroup I/O Weight Weight for the read I/O requests issued by this role. The greater the weight, the higher the priority of the requests when the host experiences I/O contention. Must be between 100 and 1000. Defaults to 1000 for processes not managed by Cloudera Manager. blkio.weight 500 rm_io_weight true
Cgroup Memory Hard Limit Hard memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 to specify no limit. By default processes not managed by Cloudera Manager will have no limit. If the value is -1, Cloudera Manager will not monitor Cgroup memory usage therefore some of the charts will show 'No Data' memory.limit_in_bytes -1 MiB rm_memory_hard_limit true
Cgroup Memory Soft Limit Soft memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process if and only if the host is facing memory pressure. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 to specify no limit. By default processes not managed by Cloudera Manager will have no limit. If the value is -1, Cloudera Manager will not monitor Cgroup memory usage therefore some of the charts will show 'No Data' memory.soft_limit_in_bytes -1 MiB rm_memory_soft_limit true
Display Name Description Related Name Default Value API Name Required
Knox IDBroker TLS/SSL Client Trust Store File The location on disk of the trust store, in .jks format, used to confirm the authenticity of TLS/SSL servers that Knox IDBroker might connect to. This is used when Knox IDBroker is the client in a TLS/SSL connection. This trust store must contain the certificate(s) used to sign the service(s) connected to. If this parameter is not provided, the default list of well-known certificate authorities is used instead. gateway.httpclient.truststore.path ssl_client_truststore_location false
Knox IDBroker TLS/SSL Client Trust Store Password The password for the Knox IDBroker TLS/SSL Certificate Trust Store File. This password is not required to access the trust store; this field can be left blank. This password provides optional integrity checking of the file. The contents of trust stores are certificates, and certificates are public information. ssl_client_truststore_password false
Enable TLS/SSL for Knox IDBroker Encrypt communication between clients and Knox IDBroker using Transport Layer Security (TLS) (formerly known as Secure Socket Layer (SSL)). false ssl_enabled false
Knox IDBroker TLS/SSL Server JKS Keystore File Location The path to the TLS/SSL keystore file containing the server certificate and private key used for TLS/SSL. Used when Knox IDBroker is acting as a TLS/SSL server. The keystore must be in JKS format. gateway.tls.keystore.path ssl_server_keystore_location false
Knox IDBroker TLS/SSL Server JKS Keystore File Password The password for the Knox IDBroker JKS keystore file. ssl_server_keystore_password false
Display Name Description Related Name Default Value API Name Required
Stacks Collection Data Retention The amount of stacks data that is retained. After the retention limit is reached, the oldest data is deleted. stacks_collection_data_retention 100 MiB stacks_collection_data_retention false
Stacks Collection Directory The directory in which stacks logs are placed. If not set, stacks are logged into a stacks subdirectory of the role's log directory. stacks_collection_directory stacks_collection_directory false
Stacks Collection Enabled Whether or not periodic stacks collection is enabled. stacks_collection_enabled false stacks_collection_enabled true
Stacks Collection Frequency The frequency with which stacks are collected. stacks_collection_frequency 5.0 second(s) stacks_collection_frequency false
Stacks Collection Method The method used to collect stacks. The jstack option involves periodically running the jstack command against the role's daemon process. The servlet method is available for those roles that have an HTTP server endpoint exposing the current stacks traces of all threads. When the servlet method is selected, that HTTP endpoint is periodically scraped. stacks_collection_method jstack stacks_collection_method false
Display Name Description Related Name Default Value API Name Required
Suppress Configuration Validator: Version Validator Whether to suppress configuration warnings produced by the Version Validator configuration validator. false role_config_suppression_cdh_version_validator true
Suppress Parameter Validation: Knox IDBroker Advanced Configuration Snippet (Safety Valve) for conf/gateway-reloadable.xml Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Advanced Configuration Snippet (Safety Valve) for conf/gateway-reloadable.xml parameter. false role_config_suppression_conf/gateway-reloadable.xml_role_safety_valve true
Suppress Parameter Validation: Knox IDBroker Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml parameter. false role_config_suppression_conf/gateway-site.xml_role_safety_valve true
Suppress Parameter Validation: Knox IDBroker AWS Credentials Key Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AWS Credentials Key parameter. false role_config_suppression_idbroker_aws_credentials_key true
Suppress Parameter Validation: Knox IDBroker AWS Credentials Secret Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AWS Credentials Secret parameter. false role_config_suppression_idbroker_aws_credentials_secret true
Suppress Parameter Validation: Knox IDBroker AWS Group Mapping Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AWS Group Mapping parameter. false role_config_suppression_idbroker_aws_group_mapping true
Suppress Parameter Validation: Knox IDBroker AWS User Mapping Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AWS User Mapping parameter. false role_config_suppression_idbroker_aws_user_mapping true
Suppress Parameter Validation: Knox IDBroker AZURE ADLS2 Tenant Name Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AZURE ADLS2 Tenant Name parameter. false role_config_suppression_idbroker_azure_adls2_tenant_name true
Suppress Parameter Validation: Knox IDBroker AZURE 'blob-contributor' ClientID Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AZURE 'blob-contributor' ClientID parameter. false role_config_suppression_idbroker_azure_blob_contributor_clientid true
Suppress Parameter Validation: Knox IDBroker AZURE 'blob-contributor' Secret Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AZURE 'blob-contributor' Secret parameter. false role_config_suppression_idbroker_azure_blob_contributor_secret true
Suppress Parameter Validation: Knox IDBroker AZURE 'blob-reader' ClientID Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AZURE 'blob-reader' ClientID parameter. false role_config_suppression_idbroker_azure_blob_reader_clientid true
Suppress Parameter Validation: Knox IDBroker AZURE 'blob-reader' Secret Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AZURE 'blob-reader' Secret parameter. false role_config_suppression_idbroker_azure_blob_reader_secret true
Suppress Parameter Validation: Knox IDBroker AZURE Group Mapping Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AZURE Group Mapping parameter. false role_config_suppression_idbroker_azure_group_mapping true
Suppress Parameter Validation: Knox IDBroker AZURE User Mapping Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker AZURE User Mapping parameter. false role_config_suppression_idbroker_azure_user_mapping true
Suppress Parameter Validation: Knox IDBroker Configuration Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Configuration Directory parameter. false role_config_suppression_idbroker_conf_dir true
Suppress Parameter Validation: Knox IDBroker Data Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Data Directory parameter. false role_config_suppression_idbroker_data_dir true
Suppress Parameter Validation: Gateway Config Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Gateway Config Directory parameter. false role_config_suppression_idbroker_gateway_gateway_conf_dir true
Suppress Parameter Validation: Admin Groups Whether to suppress configuration warnings produced by the built-in parameter validation for the Admin Groups parameter. false role_config_suppression_idbroker_gateway_knox_admin_groups true
Suppress Parameter Validation: Gateway Path Whether to suppress configuration warnings produced by the built-in parameter validation for the Gateway Path parameter. false role_config_suppression_idbroker_gateway_path true
Suppress Parameter Validation: Gateway HTTP Port Whether to suppress configuration warnings produced by the built-in parameter validation for the Gateway HTTP Port parameter. false role_config_suppression_idbroker_gateway_port true
Suppress Parameter Validation: Security - Signing Key Alias Whether to suppress configuration warnings produced by the built-in parameter validation for the Security - Signing Key Alias parameter. false role_config_suppression_idbroker_gateway_signing_key_alias true
Suppress Parameter Validation: Security - Signing Keystore Name Whether to suppress configuration warnings produced by the built-in parameter validation for the Security - Signing Keystore Name parameter. false role_config_suppression_idbroker_gateway_signing_keystore_name true
Suppress Parameter Validation: Security - Signing Keystore Type Whether to suppress configuration warnings produced by the built-in parameter validation for the Security - Signing Keystore Type parameter. false role_config_suppression_idbroker_gateway_signing_keystore_type true
Suppress Parameter Validation: Knox IDBroker GCP Credential Key Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker GCP Credential Key parameter. false role_config_suppression_idbroker_gcp_credential_key true
Suppress Parameter Validation: Knox IDBroker GCP Credential Secret Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker GCP Credential Secret parameter. false role_config_suppression_idbroker_gcp_credential_secret true
Suppress Parameter Validation: Knox IDBroker GCP Group Mapping Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker GCP Group Mapping parameter. false role_config_suppression_idbroker_gcp_group_mapping true
Suppress Parameter Validation: Knox IDBroker GCP User Mapping Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker GCP User Mapping parameter. false role_config_suppression_idbroker_gcp_user_mapping true
Suppress Parameter Validation: Admin Group Mapping - Class Name Whether to suppress configuration warnings produced by the built-in parameter validation for the Admin Group Mapping - Class Name parameter. false role_config_suppression_idbroker_hadoop_security_group_mapping_class true
Suppress Parameter Validation: Additional IDBroker Java Options Whether to suppress configuration warnings produced by the built-in parameter validation for the Additional IDBroker Java Options parameter. false role_config_suppression_idbroker_java_opts true
Suppress Parameter Validation: krb5.conf Location Whether to suppress configuration warnings produced by the built-in parameter validation for the krb5.conf Location parameter. false role_config_suppression_idbroker_java_security_krb5_conf true
Suppress Parameter Validation: Kerberos Proxyuser Block Whether to suppress configuration warnings produced by the built-in parameter validation for the Kerberos Proxyuser Block parameter. false role_config_suppression_idbroker_kerberos_dt_proxyuser_block true
Suppress Parameter Validation: Knox IDBroker Log Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Log Directory parameter. false role_config_suppression_idbroker_log_dir true
Suppress Parameter Validation: IDBroker Master Secret Whether to suppress configuration warnings produced by the built-in parameter validation for the IDBroker Master Secret parameter. false role_config_suppression_idbroker_master_secret true
Suppress Parameter Validation: Knox IDBroker Environment Advanced Configuration Snippet (Safety Valve) Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Environment Advanced Configuration Snippet (Safety Valve) parameter. false role_config_suppression_idbroker_role_env_safety_valve true
Suppress Parameter Validation: Knox IDBroker Logging Advanced Configuration Snippet (Safety Valve) Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Logging Advanced Configuration Snippet (Safety Valve) parameter. false role_config_suppression_log4j_safety_valve true
Suppress Parameter Validation: Knox IDBroker Log Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker Log Directory parameter. false role_config_suppression_log_dir true
Suppress Parameter Validation: Heap Dump Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Heap Dump Directory parameter. false role_config_suppression_oom_heap_dump_dir true
Suppress Parameter Validation: Role Triggers Whether to suppress configuration warnings produced by the built-in parameter validation for the Role Triggers parameter. false role_config_suppression_role_triggers true
Suppress Parameter Validation: Knox IDBroker TLS/SSL Client Trust Store File Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker TLS/SSL Client Trust Store File parameter. false role_config_suppression_ssl_client_truststore_location true
Suppress Parameter Validation: Knox IDBroker TLS/SSL Client Trust Store Password Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker TLS/SSL Client Trust Store Password parameter. false role_config_suppression_ssl_client_truststore_password true
Suppress Parameter Validation: Knox IDBroker TLS/SSL Server JKS Keystore File Location Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker TLS/SSL Server JKS Keystore File Location parameter. false role_config_suppression_ssl_server_keystore_location true
Suppress Parameter Validation: Knox IDBroker TLS/SSL Server JKS Keystore File Password Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox IDBroker TLS/SSL Server JKS Keystore File Password parameter. false role_config_suppression_ssl_server_keystore_password true
Suppress Parameter Validation: Stacks Collection Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Stacks Collection Directory parameter. false role_config_suppression_stacks_collection_directory true
Suppress Health Test: Audit Pipeline Test Whether to suppress the results of the Audit Pipeline Test heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_idbroker_audit_health true
Suppress Health Test: File Descriptors Whether to suppress the results of the File Descriptors heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_idbroker_file_descriptor true
Suppress Health Test: Host Health Whether to suppress the results of the Host Health heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_idbroker_host_health true
Suppress Health Test: Log Directory Free Space Whether to suppress the results of the Log Directory Free Space heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_idbroker_log_directory_free_space true
Suppress Health Test: Process Status Whether to suppress the results of the Process Status heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_idbroker_scm_health true
Suppress Health Test: Swap Memory Usage Whether to suppress the results of the Swap Memory Usage heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_idbroker_swap_memory_usage true
Suppress Health Test: Unexpected Exits Whether to suppress the results of the Unexpected Exits heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false role_health_suppression_knox_idbroker_unexpected_exits true

Categories:

Display Name Description Related Name Default Value API Name Required
Knox Service Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml For advanced use only, a string to be inserted into conf/gateway-site.xml. Applies to configurations of all roles in this service except client configuration. conf/gateway-site.xml_service_safety_valve false
Knox Service Environment Advanced Configuration Snippet (Safety Valve) For advanced use only, key-value pairs (one on each line) to be inserted into a role's environment. Applies to configurations of all roles in this service except client configuration. KNOX_service_env_safety_valve false
System Group The group that this service's processes should run as. knox process_groupname true
System User The user that this service's processes should run as. knox process_username true
Display Name Description Related Name Default Value API Name Required
Enable Service Level Health Alerts When set, Cloudera Manager will send alerts when the health of this service reaches the threshold specified by the EventServer setting eventserver_health_events_alert_threshold true enable_alerts false
Enable Configuration Change Alerts When set, Cloudera Manager will send alerts when this entity's configuration changes. false enable_config_alerts false
Healthy Knox IDBroker Monitoring Thresholds The health test thresholds of the overall Knox IDBroker health. The check returns "Concerning" health if the percentage of "Healthy" Knox IDBrokers falls below the warning threshold. The check is unhealthy if the total percentage of "Healthy" and "Concerning" Knox IDBrokers falls below the critical threshold. Warning: 99.0 %, Critical: 49.0 % KNOX_IDBROKER_healthy_thresholds false
Healthy Knox Gateway Monitoring Thresholds The health test thresholds of the overall Knox Gateway health. The check returns "Concerning" health if the percentage of "Healthy" Knox Gateways falls below the warning threshold. The check is unhealthy if the total percentage of "Healthy" and "Concerning" Knox Gateways falls below the critical threshold. Warning: 99.0 %, Critical: 49.0 % KNOX_KNOX_GATEWAY_healthy_thresholds false
Service Triggers The configured triggers for this service. This is a JSON-formatted list of triggers. These triggers are evaluated as part as the health system. Every trigger expression is parsed, and if the trigger condition is met, the list of actions provided in the trigger expression is executed. Each trigger has the following fields:
  • triggerName (mandatory) - The name of the trigger. This value must be unique for the specific service.
  • triggerExpression (mandatory) - A tsquery expression representing the trigger.
  • streamThreshold (optional) - The maximum number of streams that can satisfy a condition of a trigger before the condition fires. By default set to 0, and any stream returned causes the condition to fire.
  • enabled (optional) - By default set to 'true'. If set to 'false', the trigger is not evaluated.
  • expressionEditorConfig (optional) - Metadata for the trigger editor. If present, the trigger should only be edited from the Edit Trigger page; editing the trigger here can lead to inconsistencies.
For example, the followig JSON formatted trigger fires if there are more than 10 DataNodes with more than 500 file descriptors opened:[{"triggerName": "sample-trigger", "triggerExpression": "IF (SELECT fd_open WHERE roleType = DataNode and last(fd_open) > 500) DO health:bad", "streamThreshold": 10, "enabled": "true"}]See the trigger rules documentation for more details on how to write triggers using tsquery.The JSON format is evolving and may change and, as a result, backward compatibility is not guaranteed between releases.		 [] service_triggers true
Service Monitor Derived Configs Advanced Configuration Snippet (Safety Valve) For advanced use only, a list of derived configuration properties that will be used by the Service Monitor instead of the default ones. smon_derived_configs_safety_valve false
Display Name Description Related Name Default Value API Name Required
HDFS Service Name of the HDFS service that this Knox service instance depends on hdfs_service false
Enable Kerberos Authentication Boolean flag indicating whether the Hadoop cluster protected by Gateway is secured with Kerberos gateway.hadoop.kerberos.secured false kerberos.auth.enabled false
Ranger Knox Plugin Hdfs Audit Directory The HDFS path on which Ranger audits are written. ranger_knox_plugin_hdfs_audit_directory $ranger_base_audit_url/knox ranger_knox_plugin_hdfs_audit_directory false
RANGER Service Name of the RANGER service that this Knox service instance depends on ranger_service false
Display Name Description Related Name Default Value API Name Required
Kerberos Principal Kerberos principal short name used by all roles of this service. knox kerberos_princ_name true
Display Name Description Related Name Default Value API Name Required
Suppress Parameter Validation: Knox Service Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Service Advanced Configuration Snippet (Safety Valve) for conf/gateway-site.xml parameter. false service_config_suppression_conf/gateway-site.xml_service_safety_valve true
Suppress Configuration Validator: Knox IDBroker Count Validator Whether to suppress configuration warnings produced by the Knox IDBroker Count Validator configuration validator. false service_config_suppression_idbroker_count_validator true
Suppress Parameter Validation: Kerberos Principal Whether to suppress configuration warnings produced by the built-in parameter validation for the Kerberos Principal parameter. false service_config_suppression_kerberos_princ_name true
Suppress Configuration Validator: Knox Gateway Count Validator Whether to suppress configuration warnings produced by the Knox Gateway Count Validator configuration validator. false service_config_suppression_knox_gateway_count_validator true
Suppress Parameter Validation: Knox Service Environment Advanced Configuration Snippet (Safety Valve) Whether to suppress configuration warnings produced by the built-in parameter validation for the Knox Service Environment Advanced Configuration Snippet (Safety Valve) parameter. false service_config_suppression_knox_service_env_safety_valve true
Suppress Parameter Validation: System Group Whether to suppress configuration warnings produced by the built-in parameter validation for the System Group parameter. false service_config_suppression_process_groupname true
Suppress Parameter Validation: System User Whether to suppress configuration warnings produced by the built-in parameter validation for the System User parameter. false service_config_suppression_process_username true
Suppress Parameter Validation: Ranger Knox Plugin Hdfs Audit Directory Whether to suppress configuration warnings produced by the built-in parameter validation for the Ranger Knox Plugin Hdfs Audit Directory parameter. false service_config_suppression_ranger_knox_plugin_hdfs_audit_directory true
Suppress Parameter Validation: Service Triggers Whether to suppress configuration warnings produced by the built-in parameter validation for the Service Triggers parameter. false service_config_suppression_service_triggers true
Suppress Parameter Validation: Service Monitor Derived Configs Advanced Configuration Snippet (Safety Valve) Whether to suppress configuration warnings produced by the built-in parameter validation for the Service Monitor Derived Configs Advanced Configuration Snippet (Safety Valve) parameter. false service_config_suppression_smon_derived_configs_safety_valve true
Suppress Health Test: Knox IDBroker Health Whether to suppress the results of the Knox IDBroker Health heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false service_health_suppression_knox_idbroker_healthy true
Suppress Health Test: Knox Gateway Health Whether to suppress the results of the Knox Gateway Health heath test. The results of suppressed health tests are ignored when computing the overall health of the associated host, role or service, so suppressed health tests will not generate alerts. false service_health_suppression_knox_knox_gateway_healthy true

We want your opinion

How can we improve this page?

What kind of feedback do you have?