Kudu authentication with Kerberos
Configure authentication on Kudu servers. Authentication in Kudu is designed to interoperate with other secure Hadoop components by utilizing Kerberos.
Configure authentication on Kudu servers using the
--rpc_authentication
flag, which can be set to one of the following options:
-
required- Kudu will reject connections from clients and servers who lack authentication credentials. -
optional- Kudu will attempt to use strong authentication, but will allow unauthenticated connections. -
disabled- Kudu will only allow unauthenticated connections.
optional. To secure your cluster, set
--rpc_authentication to required.
Scalability
Kudu authentication is designed to scale to thousands of nodes, which means it must avoid unnecessary coordination with a central authentication authority (such as the Kerberos KDC) for each connection.
Instead, Kudu servers and clients use Kerberos to establish initial trust with the Kudu master, and then use alternate credentials for subsequent connections. As described previously, the Kudu master issues internal X.509 certificates to tablet servers on startup, and temporary authentication tokens to clients on first contact.
