Java KeyStore KMS Properties in CDH 5.7.0

Role groups:

keymanagementserver
service_wide

keymanagementserver

Advanced

Display Name	Description	Default Value	API Name	Required
Key Management Server Advanced Configuration Snippet (Safety Valve) for core-site.xml	For advanced use only. A string to be inserted into core-site.xml for this role only.		`core-site.xml_role_safety_valve`	false
Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-acls.xml	For advanced use only. A string to be inserted into kms-acls.xml for this role only.		`kms-acls.xml_role_safety_valve`	false
Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-site.xml	For advanced use only. A string to be inserted into kms-site.xml for this role only.		`kms-site.xml_role_safety_valve`	false
Key Management Server Environment Advanced Configuration Snippet (Safety Valve)	For advanced use only, key-value pairs (one on each line) to be inserted into a role's environment. Applies to configurations of this role except client configuration.		`KMS_role_env_safety_valve`	false
Key Management Server Logging Advanced Configuration Snippet (Safety Valve)	For advanced use only, a string to be inserted into log4j.properties for this role only.		`log4j_safety_valve`	false
Automatically Restart Process	When set, this role's process is automatically (and transparently) restarted in the event of an unexpected failure.	false	`process_auto_restart`	true

Logs

Display Name	Description	Related Name	Default Value	API Name	Required
Key Management Server Log Directory	The log directory for log files of the role Key Management Server.	`log.dir`	/var/log/hadoop-kms	`log_dir`	false
Key Management Server Logging Threshold	The minimum log level for Key Management Server logs		INFO	`log_threshold`	false
Key Management Server Maximum Log File Backups	The maximum number of rolled log files to keep for Key Management Server logs. Typically used by log4j or logback.		10	`max_log_backup_index`	false
Key Management Server Max Log Size	The maximum size, in megabytes, per log file for Key Management Server logs. Typically used by log4j or logback.		200 MiB	`max_log_size`	false

Monitoring

Display Name	Description	Related Name	Default Value	API Name	Required
Enable Configuration Change Alerts	When set, Cloudera Manager will send alerts when this entity's configuration changes.		false	`enable_config_alerts`	false

Other

Display Name	Description	Related Name	Default Value	API Name	Required
Flume Proxy User Groups	Allows the flume superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.flume.groups`	*	`hadoop_kms_proxyuser_flume_groups`	false
Flume Proxy User Hosts	Comma-delimited list of hosts where you want to allow the flume user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.flume.hosts`	*	`hadoop_kms_proxyuser_flume_hosts`	false
HDFS Proxy User Groups	Allows the hdfs superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.hdfs.groups`	*	`hadoop_kms_proxyuser_hdfs_groups`	false
HDFS Proxy User Hosts	Comma-delimited list of hosts where you want to allow the hdfs user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.hdfs.hosts`	*	`hadoop_kms_proxyuser_hdfs_hosts`	false
Hive Proxy User Groups	Allows the hive superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.hive.groups`	*	`hadoop_kms_proxyuser_hive_groups`	false
Hive Proxy User Hosts	Comma-delimited list of hosts where you want to allow the hive user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.hive.hosts`	*	`hadoop_kms_proxyuser_hive_hosts`	false
HTTP Proxy User Groups	Allows the HTTP superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.HTTP.groups`	*	`hadoop_kms_proxyuser_HTTP_groups`	false
HTTP Proxy User Hosts	Comma-delimited list of hosts where you want to allow the HTTP user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.HTTP.hosts`	*	`hadoop_kms_proxyuser_HTTP_hosts`	false
HttpFS Proxy User Groups	Allows the httpfs superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.httpfs.groups`	*	`hadoop_kms_proxyuser_httpfs_groups`	false
HttpFS Proxy User Hosts	Comma-delimited list of hosts where you want to allow the httpfs user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.httpfs.hosts`	*	`hadoop_kms_proxyuser_httpfs_hosts`	false
Hue Proxy User Groups	Allows the hue superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.hue.groups`	*	`hadoop_kms_proxyuser_hue_groups`	false
Hue Proxy User Hosts	Comma-delimited list of hosts where you want to allow the hue user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.hue.hosts`	*	`hadoop_kms_proxyuser_hue_hosts`	false
Mapred Proxy User Groups	Allows the mapred superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.mapred.groups`	*	`hadoop_kms_proxyuser_mapred_groups`	false
Mapred Proxy User Hosts	Comma-delimited list of hosts where you want to allow the mapred user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.mapred.hosts`	*	`hadoop_kms_proxyuser_mapred_hosts`	false
Oozie Proxy User Groups	Allows the oozie superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.oozie.groups`	*	`hadoop_kms_proxyuser_oozie_groups`	false
Oozie Proxy User Hosts	Comma-delimited list of hosts where you want to allow the oozie user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.oozie.hosts`	*	`hadoop_kms_proxyuser_oozie_hosts`	false
YARN Proxy User Groups	Allows the yarn superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.	`hadoop.kms.proxyuser.yarn.groups`	*	`hadoop_kms_proxyuser_yarn_groups`	false
YARN Proxy User Hosts	Comma-delimited list of hosts where you want to allow the yarn user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.	`hadoop.kms.proxyuser.yarn.hosts`	*	`hadoop_kms_proxyuser_yarn_hosts`	false
JavaKeyStoreProvider Directory	Directory of the keystore file kms.keystore used by JavaKeyStoreProvider that backs the KMS.	`hadoop.kms.key.provider.uri`	/var/lib/kms	`hadoop_security_key_provider_dir`	true
KMS Blacklist Users	A comma-separated list of users (no spaces) for whom to disallow access to key material. These users can still fetch key metadata and create encrypted encryption keys, but are unable to do any other KMS operations. Typically, HDFS superusers will be specified here.	`kms_blacklist_users`		`kms_blacklist_users`	false
KMS Heap Size	Maximum heap size of the KMS.	`kms_heap_size`	1 GiB	`kms_heap_size`	true
KMS Max Threads	Maximum number of threads used to handle KMS requests.	`kms_max_threads`	250	`kms_max_threads`	false
KMS Staging Directory	Directory where configuration and binaries are staged before starting KMS. Does not normally need to be modified.	`kms_staging_dir`	/var/lib/hadoop-kms	`kms_staging_dir`	true

Performance

Display Name	Description	Related Name	Default Value	API Name	Required
Maximum Process File Descriptors	If configured, overrides the process soft and hard rlimits (also called ulimits) for file descriptors to the configured value.			`rlimit_fds`	false

Ports and Addresses

Display Name	Description	Related Name	Default Value	API Name	Required
KMS Admin Port	Port used to access the KMS' embedded Tomcat admin console.	`kms_admin_port`	16001	`kms_admin_port`	true
KMS HTTP Port	Port used by clients to interact with the KMS.	`kms_http_port`	16000	`kms_http_port`	true

Resource Management

Display Name	Description	Related Name	Default Value	API Name	Required
Cgroup CPU Shares	Number of CPU shares to assign to this role. The greater the number of shares, the larger the share of the host's CPUs that will be given to this role when the host experiences CPU contention. Must be between 2 and 262144. Defaults to 1024 for processes not managed by Cloudera Manager.	`cpu.shares`	1024	`rm_cpu_shares`	true
Cgroup I/O Weight	Weight for the read I/O requests issued by this role. The greater the weight, the higher the priority of the requests when the host experiences I/O contention. Must be between 100 and 1000. Defaults to 1000 for processes not managed by Cloudera Manager.	`blkio.weight`	500	`rm_io_weight`	true
Cgroup Memory Hard Limit	Hard memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 B to specify no limit. By default processes not managed by Cloudera Manager will have no limit.	`memory.limit_in_bytes`	-1 MiB	`rm_memory_hard_limit`	true
Cgroup Memory Soft Limit	Soft memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process if and only if the host is facing memory pressure. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 B to specify no limit. By default processes not managed by Cloudera Manager will have no limit.	`memory.soft_limit_in_bytes`	-1 MiB	`rm_memory_soft_limit`	true

Security

Display Name	Description	Default Value	API Name	Required
Enable TLS/SSL for Key Management Server	Encrypt communication between clients and Key Management Server using Transport Layer Security (TLS) (formerly known as Secure Socket Layer (SSL)).	false	`ssl_enabled`	false
Key Management Server TLS/SSL Server JKS Keystore File Location	The path to the TLS/SSL keystore file containing the server certificate and private key used for TLS/SSL. Used when Key Management Server is acting as a TLS/SSL server. The keystore must be in JKS format.		`ssl_server_keystore_location`	false
Key Management Server TLS/SSL Server JKS Keystore File Password	The password for the Key Management Server JKS keystore file.		`ssl_server_keystore_password`	false

Suppressions

Display Name	Description	Default Value	API Name	Required
Suppress Configuration Validator: CDH Version Validator	Whether to suppress configuration warnings produced by the CDH Version Validator configuration validator.	false	`role_config_suppression_cdh_version_validator`	true
Suppress Parameter Validation: Key Management Server Advanced Configuration Snippet (Safety Valve) for core-site.xml	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server Advanced Configuration Snippet (Safety Valve) for core-site.xml parameter.	false	`role_config_suppression_core-site.xml_role_safety_valve`	true
Suppress Parameter Validation: Flume Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the Flume Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_flume_groups`	true
Suppress Parameter Validation: Flume Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the Flume Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_flume_hosts`	true
Suppress Parameter Validation: HDFS Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the HDFS Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_hdfs_groups`	true
Suppress Parameter Validation: HDFS Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the HDFS Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_hdfs_hosts`	true
Suppress Parameter Validation: Hive Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the Hive Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_hive_groups`	true
Suppress Parameter Validation: Hive Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the Hive Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_hive_hosts`	true
Suppress Parameter Validation: HTTP Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the HTTP Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_http_groups`	true
Suppress Parameter Validation: HTTP Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the HTTP Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_http_hosts`	true
Suppress Parameter Validation: HttpFS Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the HttpFS Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_httpfs_groups`	true
Suppress Parameter Validation: HttpFS Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the HttpFS Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_httpfs_hosts`	true
Suppress Parameter Validation: Hue Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the Hue Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_hue_groups`	true
Suppress Parameter Validation: Hue Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the Hue Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_hue_hosts`	true
Suppress Parameter Validation: Mapred Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the Mapred Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_mapred_groups`	true
Suppress Parameter Validation: Mapred Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the Mapred Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_mapred_hosts`	true
Suppress Parameter Validation: Oozie Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the Oozie Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_oozie_groups`	true
Suppress Parameter Validation: Oozie Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the Oozie Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_oozie_hosts`	true
Suppress Parameter Validation: YARN Proxy User Groups	Whether to suppress configuration warnings produced by the built-in parameter validation for the YARN Proxy User Groups parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_yarn_groups`	true
Suppress Parameter Validation: YARN Proxy User Hosts	Whether to suppress configuration warnings produced by the built-in parameter validation for the YARN Proxy User Hosts parameter.	false	`role_config_suppression_hadoop_kms_proxyuser_yarn_hosts`	true
Suppress Parameter Validation: JavaKeyStoreProvider Directory	Whether to suppress configuration warnings produced by the built-in parameter validation for the JavaKeyStoreProvider Directory parameter.	false	`role_config_suppression_hadoop_security_key_provider_dir`	true
Suppress Parameter Validation: Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-acls.xml	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-acls.xml parameter.	false	`role_config_suppression_kms-acls.xml_role_safety_valve`	true
Suppress Parameter Validation: Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-site.xml	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-site.xml parameter.	false	`role_config_suppression_kms-site.xml_role_safety_valve`	true
Suppress Parameter Validation: KMS Blacklist Users	Whether to suppress configuration warnings produced by the built-in parameter validation for the KMS Blacklist Users parameter.	false	`role_config_suppression_kms_blacklist_users`	true
Suppress Parameter Validation: Key Management Server Environment Advanced Configuration Snippet (Safety Valve)	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server Environment Advanced Configuration Snippet (Safety Valve) parameter.	false	`role_config_suppression_kms_role_env_safety_valve`	true
Suppress Parameter Validation: KMS Staging Directory	Whether to suppress configuration warnings produced by the built-in parameter validation for the KMS Staging Directory parameter.	false	`role_config_suppression_kms_staging_dir`	true
Suppress Parameter Validation: Key Management Server Logging Advanced Configuration Snippet (Safety Valve)	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server Logging Advanced Configuration Snippet (Safety Valve) parameter.	false	`role_config_suppression_log4j_safety_valve`	true
Suppress Parameter Validation: Key Management Server Log Directory	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server Log Directory parameter.	false	`role_config_suppression_log_dir`	true
Suppress Parameter Validation: Key Management Server TLS/SSL Server JKS Keystore File Location	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server TLS/SSL Server JKS Keystore File Location parameter.	false	`role_config_suppression_ssl_server_keystore_location`	true
Suppress Parameter Validation: Key Management Server TLS/SSL Server JKS Keystore File Password	Whether to suppress configuration warnings produced by the built-in parameter validation for the Key Management Server TLS/SSL Server JKS Keystore File Password parameter.	false	`role_config_suppression_ssl_server_keystore_password`	true

service_wide

Advanced

Display Name	Description	Default Value	API Name	Required
Java KeyStore KMS Service Environment Advanced Configuration Snippet (Safety Valve)	For advanced use only, key-value pairs (one on each line) to be inserted into a role's environment. Applies to configurations of all roles in this service except client configuration.		`KMS_service_env_safety_valve`	false
System Group	The group that this service's processes should run as.	kms	`process_groupname`	true
System User	The user that this service's processes should run as.	kms	`process_username`	true

Monitoring

Display Name	Description	Related Name	Default Value	API Name	Required
Enable Configuration Change Alerts	When set, Cloudera Manager will send alerts when this entity's configuration changes.		false	`enable_config_alerts`	false

Other

Display Name	Description	Related Name	Default Value	API Name	Required
Authentication Type	Authentication type for the KMS. Can either be "simple" or "kerberos".	`hadoop.kms.authentication.type`	simple	`hadoop_kms_authentication_type`	true

Suppressions

Display Name	Description	Default Value	API Name	Required
Suppress Configuration Validator: Key Management Server Count Validator	Whether to suppress configuration warnings produced by the Key Management Server Count Validator configuration validator.	false	`service_config_suppression_kms_count_validator`	true
Suppress Parameter Validation: Java KeyStore KMS Service Environment Advanced Configuration Snippet (Safety Valve)	Whether to suppress configuration warnings produced by the built-in parameter validation for the Java KeyStore KMS Service Environment Advanced Configuration Snippet (Safety Valve) parameter.	false	`service_config_suppression_kms_service_env_safety_valve`	true
Suppress Parameter Validation: System Group	Whether to suppress configuration warnings produced by the built-in parameter validation for the System Group parameter.	false	`service_config_suppression_process_groupname`	true
Suppress Parameter Validation: System User	Whether to suppress configuration warnings produced by the built-in parameter validation for the System User parameter.	false	`service_config_suppression_process_username`	true

Isilon Properties in CDH 5.7.0

Kafka Properties in CDH 5.7.0