Cloudera Docs

Supporting Cloudera Observability On-Premises with Apache Ranger

If you have installed Apache Ranger for Cloudera Observability On-Premises, Cloudera suggests that you set the Apache Ranger properties to specify super users for the HBase, HDFS, Hive, Impala, and Kafka services.

Describes how to set the super user properties for Apache Ranger in Cloudera Manager for the Cloudera Observability On-Premises services listed in the following table.
Table 1. Apache Ranger settings
Service Setting Name Value
HBase HBase Service Advanced Configuration Snippet (Safety Valve) for ranger-hbase-security.xml ranger.plugin.hbase.super.users observability
HDFS HDFS Service Advanced Configuration Snippet (Safety Valve) for ranger-hdfs-security.xml ranger.plugin.hdfs.super.users
Hive Hive Service Advanced Configuration Snippet (Safety Valve) for ranger-hive-security.xml ranger.plugin.hive.super.users
Kafka Kafka Service Advanced Configuration Snippet (Safety Valve) for ranger-kafka-security.xml ranger.plugin.kafka.super.users
  1. In a supported web browser on the Cloudera Observability On-Premises cluster, log in to Cloudera Manager.
  2. In Cloudera Manager, select Clusters and then select the Service name. For example, HBase.
  3. In the Service name page, click the Configuration tab and then search for the HBase Service Advanced Configuration Snippet (Safety Valve) for ranger-hbase-security.xml setting for the HBase service.
  4. In the Name field, enter ranger.plugin.hbase.super.users.
  5. In the Value field, enter observability.
  6. Click Save Changes.
  7. Repeat these steps for each service using the Apache Ranger settings table.
  8. For the Impala service, add a custom policy in Apache Ranger for Hadoop SQL.
    1. Manually add a new user named observability in Apache Ranger for the Observability service. For information, see Adding a user in Cloudera Private Cloud Base documentation.
    2. Assign full privileges to the new observability user on all databases and schemas. For information on granting user access using Apache Ranger, see Impala Authorization in CDP Private Cloud Data Warehouse Runtime documentation.