Cloudera Docs

Enabling ZooKeeper SSL/TLS for Solr and HBase Indexer

Learn about configuring Solr and HBase Indexer to communicate with ZooKeeper in a secure way.

When you enable secure SSL/TLS communication with ZooKeeper, both Solr and HBase Indexer use a default secure port, 2182, instead of the insecure port, 2181.

Enabling SSL for Solr ZooKeeper

Learn about enabling secure communications between Solr and ZooKeeper.

This topic covers TLS for communication between Solr and ZooKeeper. It does not configure Hive external tables that connect to Solr through solr.zkhost. When Solr ZooKeeper TLS is enabled, set lww.zookeeper.secure to true and the related lww.* table properties on Hive-Solr connector tables. For more information, see Create an external Hive table for Solr.

The Enable TLS/SSL for ZooKeeper option must be enabled in the ZooKeeper configuration. This is a default setting for a secure cluster.

  1. In Cloudera Manager, select the Solr service for which you want to enable secure communication.
  2. Click the Configuration tab.
  3. Search for SSL.
  4. Find the Enable TLS/SSL for Solr ZooKeeper property and select it to enable TLS/SSL.
  5. Click Save Changes.
  6. Restart.

When you run standalone Search ZooKeeper CLI tools such as zkcli.sh, zksynctool.sh, or snapshotscli.sh, set ZKCLI_JVM_FLAGS as described in Using Search ZooKeeper CLI tools with TLS-enabled ZooKeeper.

Using Search ZooKeeper CLI tools with TLS-enabled ZooKeeper

Set ZKCLI_JVM_FLAGS before you run Search shell tools that connect directly to ZooKeeper when Solr ZooKeeper TLS is enabled.

The solrctl command handles secure ZooKeeper connections automatically when Solr ZooKeeper TLS is configured in Cloudera Manager. The following standalone tools read ZKCLI_JVM_FLAGS and require additional JVM options when Solr uses a TLS-enabled ZooKeeper quorum:

  • zkcli.sh — run low-level ZooKeeper maintenance commands (for example, updateacls or putfile)
  • zksynctool.sh — synchronize Solr-related ZooKeeper data
  • snapshotscli.sh — manage Solr snapshots through ZooKeeper

These scripts are located under /opt/cloudera/parcels/CDH/lib/solr/bin/.

Enable TLS for Solr ZooKeeper in Cloudera Manager. For more information, see Enabling SSL for Solr ZooKeeper.

  1. Export ZKCLI_JVM_FLAGS with the ZooKeeper TLS client options: 
    export ZKCLI_JVM_FLAGS="-Dzookeeper.client.secure=true \
-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty \
-Dzookeeper.ssl.trustStore.location=[***PATH/TO/TRUSTSTORE***] \
-Dzookeeper.ssl.trustStore.password=[***TRUSTSTORE_PASSWORD***]"

    Replace [***PATH/TO/TRUSTSTORE***] with the path to a JKS truststore that is available on the host where you run the command, such as the Cloudera Manager AutoTLS global truststore at /var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks.

    Replace [***TRUSTSTORE_PASSWORD***] with the truststore password. Leave the value empty if the truststore does not use a password.

  2. On a Kerberized cluster, append Kerberos and ACL settings to the same ZKCLI_JVM_FLAGS variable before you run zkcli.sh.

    For example:

    export ZKCLI_JVM_FLAGS="-Dzookeeper.client.secure=true \
-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty \
-Dzookeeper.ssl.trustStore.location=[***PATH/TO/TRUSTSTORE***] \
-Dzookeeper.ssl.trustStore.password=[***TRUSTSTORE_PASSWORD***] \
-Djava.security.auth.login.config=[***PATH/TO/JAAS.CONF***] \
-DzkACLProvider=org.apache.solr.common.cloud.SaslZkACLProvider \
-Droot.logger=INFO,console"
  3. Run the required tool from /opt/cloudera/parcels/CDH/lib/solr/bin/.

Enabling SSL for HBase Indexer ZooKeeper

Learn about enabling secure communication between HBase Indexer and ZooKeeper.

This topic covers TLS for communication between the Lily HBase Indexer and ZooKeeper. It does not configure RPC or server-mode TLS for the HBase Indexer role. To configure TLS protocol versions, cipher suites, and server-mode TLS for the HBase Indexer, see Configure Lily HBase Indexer to use TLS/SSL.

  • The Enable TLS/SSL for ZooKeeper option must be enabled in the ZooKeeper configuration. This is a default setting for a secure cluster.
  • The Enable TLS/SSL for Solr Zookeeper must be selected for the Solr service used with HBase Indexer. When you disable SSL/TLS for HBase indexer ZooKeepeer, ensure that you disable it for the Solr service as well.
  • The HBase ZooKeeper Secure Client Enabled option must be enabled in the HBase configuration.
  1. In Cloudera Manager, select the HBase service for which you want to enable secure communication.
  2. Click the Configuration tab.
  3. Search for SSL.
  4. Find the Enable TLS/SSL for HBase ZooKeeper property and select it to enable TLS/SSL.
  5. Click Save Changes.
  6. Restart.