Provision a new Data Lake and Cloudera Data Hub with database
TLS/SSL enforced from creation. After the clusters are created, you need to migrate your
workloads and delete the source clusters. This is a recommended option when you want to
avoid manual Cloudera Manager file modifications and you have verified
that the enforced TLS/SSL is supported for the managed database for your cloud provider and
Cloudera
on cloud version.
-
Plan the target cluster with the same or upgraded Cloudera Runtime version, database tier and TLS/SSL enablement
per security policy.
-
Provisioning the new environment and cluster using CDP CLI or the Cloudera Management Console with TLS/SSL enabled for the database.
-
Validate the database connectivity with TLS/SSL.
You can use the following example commands for the
verification:
For External Database:
psql "host=your-db-instance port=5432 dbname=DB_NAME user=DB_USER sslmode=verify-full sslrootcert=/hadoopfs/fs*/database-cacerts/certs.pem"
For Embedded Database:
psql "host=localhost port=5432 dbname=DB_NAME user=DB_USER sslmode=verify-ca sslrootcert=/hadoopfs/fs*/database-cacerts/certs.pem"
You need to confirm the following items after
provisioning the new clusters:
- Database with TLS/SSL enabled and correct CA trust.
- Cloudera Manager and services are using the
JDBC URLs / Cloudera Manager database settings that
expect TLS. The connection information can be found in the db.properties
file as shown in the following example:
jdbc:postgresql://<hostname>:5432/DB_NAME?ssl=true&sslmode=verify-full&sslrootcert=/hadoopfs/fs*/database-cacerts/certs.pem
-
Migrate your workloads and delete the source clusters.
