Configuring TLS/SSL for Oozie
Minimum Required Role: Configurator (also provided by Cluster Administrator, Full Administrator)
Before You Begin
- Keystores for Oozie must be readable by the oozie user. This can be a copy of the Hadoop services' keystore with permissions set to 0440 and owned by the oozie group.
- Truststores must have permissions set to 0444, which means that all users can read them.
- Specify absolute paths to the keystore and truststore files. These settings apply to all hosts on which daemon roles of the Oozie service run so the paths you choose must be valid on all hosts.
- If there is a DataNode and an Oozie server running on the same host, they can use the same certificate.
Using Cloudera Manager
The steps for configuring and enabling Hadoop TLS/SSL for Oozie are as follows:
- Open the Cloudera Manager Admin Console and go to the Oozie service.
- Click the Configuration tab.
- In the Search field, type TLS/SSL to show the Oozie TLS/SSL properties.
- Edit the following TLS/SSL properties according to your cluster configuration.
Oozie TLS/SSL Properties Property Description Enable TLS/SSL for Oozie Check this field to enable TLS/SSL for Oozie. Oozie TLS/SSL Server JKS Keystore File Location Location of the keystore file on the local file system. Oozie TLS/SSL Server JKS Keystore File Password Password for the keystore. - Click Save Changes.
- Restart the Oozie service.
Additional Considerations when Configuring TLS/SSL for Oozie HA
To enable clients to connect to Oozie servers (the target servers) through the load balancer using TLS/SSL, configure the load balancer for TLS/SSL pass-through. This means that the load balancer does not perform encryption or decryption but instead passes traffic from clients and servers to the appropriate target host. See the documentation for your load balancer for details.