Enabling ZooKeeper SSL/TLS for Solr and HBase Indexer

Learn about configuring Solr and HBase Indexer to communicate with ZooKeeper in a secure way.

When you enable secure SSL/TLS communication with ZooKeeper, both Solr and HBase Indexer use a default secure port, 2182, instead of the insecure port, 2181.

Solr ZooKeeper TLS client mode is disabled by default in Cloudera Manager, even on secure clusters where the ZooKeeper service already uses TLS. To use TLS between Solr, HBase Indexer, and Solr ZooKeeper, enable all of the following Cloudera Manager properties:

Table 1. Search ZooKeeper TLS client properties
Service	Cloudera Manager property	Configuration property	Default
Solr	Enable TLS/SSL for Solr Zookeeper	`solr.zookeeper.ssl.client.enable`	`false`
Key-Value Store Indexer	Enable TLS/SSL for HBase Indexer Zookeeper	`hbaseindexer.zookeeper.ssl.client.enable`	`false`
HBase	HBase ZooKeeper Secure Client Enabled	`hbase.zookeeper.property.client.secure`	`false`

Enable every property in the table for end-to-end Search ZooKeeper TLS. If you enable only part of the set, some clients may still use plaintext ZooKeeper connections.

For service-specific steps, see:

On the HBase service, enable HBase ZooKeeper Secure Client Enabled as described in the table before you restart dependent Search services.

After you enable Solr ZooKeeper TLS in Cloudera Manager, configure client-side settings where needed:

Hive-Solr external tables — lww.zookeeper.secure and related lww.* properties. See Create an external Hive table for Solr.
ZooKeeper shell tools — ZKCLI_JVM_FLAGS. See Using Search ZooKeeper CLI tools with TLS-enabled ZooKeeper.
MapReduceIndexerTool go-live with --zk-host — JVM options on the client and on map and reduce tasks. For more information, see MapReduceIndexerTool usage syntax and Using --go-live with SSL, Kerberos, or ZooKeeper TLS.

Enabling SSL for Solr ZooKeeper

Learn about enabling secure communications between Solr and ZooKeeper.

This topic covers TLS for communication between Solr and ZooKeeper. It does not configure Solr HTTPS or Hive external tables that connect to Solr through solr.zkhost. When Solr ZooKeeper TLS is enabled, set lww.zookeeper.secure to true and the related lww.* table properties on Hive-Solr connector tables. For more information, see Create an external Hive table for Solr.

The Enable TLS/SSL for Solr Zookeeper property is disabled by default. For the full set of Search ZooKeeper TLS properties to enable in Cloudera Manager, see Enabling ZooKeeper SSL/TLS for Solr and HBase Indexer.

The Enable TLS/SSL for ZooKeeper option must be enabled in the ZooKeeper configuration. This is a default setting for a secure cluster.
Enable HBase ZooKeeper Secure Client Enabled on the HBase service and Enable TLS/SSL for HBase Indexer Zookeeper on the Key-Value Store Indexer service. See Enabling ZooKeeper SSL/TLS for Solr and HBase Indexer and Enabling SSL for HBase Indexer ZooKeeper.

In Cloudera Manager, select the Solr service for which you want to enable secure communication.
Click the Configuration tab.
Search for SSL.
Find the Enable TLS/SSL for Solr Zookeeper property and select it to enable TLS/SSL.
Click Save Changes.
Restart the Solr service and any dependent services.

When you run standalone Search ZooKeeper CLI tools such as zkcli.sh, zksynctool.sh, or snapshotscli.sh, set ZKCLI_JVM_FLAGS as described in Using Search ZooKeeper CLI tools with TLS-enabled ZooKeeper.

Using Search ZooKeeper CLI tools with TLS-enabled ZooKeeper

Set ZKCLI_JVM_FLAGS before you run Search shell tools that connect directly to ZooKeeper when Solr ZooKeeper TLS is enabled.

The solrctl command handles secure ZooKeeper connections automatically when Solr ZooKeeper TLS is configured in Cloudera Manager. The following standalone tools read ZKCLI_JVM_FLAGS and require additional JVM options when Solr uses a TLS-enabled ZooKeeper quorum:

zkcli.sh — run low-level ZooKeeper maintenance commands (for example, updateacls or putfile)
zksynctool.sh — synchronize Solr-related ZooKeeper data
snapshotscli.sh — manage Solr snapshots through ZooKeeper

These scripts are located under /opt/cloudera/parcels/CDH/lib/solr/bin/.

Enable TLS for Solr ZooKeeper in Cloudera Manager. For more information, see Enabling SSL for Solr ZooKeeper.

Export ZKCLI_JVM_FLAGS with the ZooKeeper TLS client options:
```
export ZKCLI_JVM_FLAGS="-Dzookeeper.client.secure=true \
-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty \
-Dzookeeper.ssl.trustStore.location=[***PATH/TO/TRUSTSTORE***] \
-Dzookeeper.ssl.trustStore.password=[***TRUSTSTORE_PASSWORD***]"
```
Replace [***PATH/TO/TRUSTSTORE***] with the path to a JKS truststore that is available on the host where you run the command, such as the Cloudera Manager AutoTLS global truststore at /var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks.

Replace [***TRUSTSTORE_PASSWORD***] with the truststore password. Leave the value empty if the truststore does not use a password.

On a Kerberized cluster, append Kerberos and ACL settings to the same ZKCLI_JVM_FLAGS variable before you run zkcli.sh.

For example:

export ZKCLI_JVM_FLAGS="-Dzookeeper.client.secure=true \
-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty \
-Dzookeeper.ssl.trustStore.location=[***PATH/TO/TRUSTSTORE***] \
-Dzookeeper.ssl.trustStore.password=[***TRUSTSTORE_PASSWORD***] \
-Djava.security.auth.login.config=[***PATH/TO/JAAS.CONF***] \
-DzkACLProvider=org.apache.solr.common.cloud.SaslZkACLProvider \
-Droot.logger=INFO,console"

Run the required tool from /opt/cloudera/parcels/CDH/lib/solr/bin/.

note
Use the ZooKeeper client port configured for TLS on your cluster. The secure client port may differ from the default plaintext port 2181.

Enabling SSL for HBase Indexer ZooKeeper

Learn about enabling secure communication between HBase Indexer and ZooKeeper.

This topic covers TLS for communication between the Lily HBase Indexer and ZooKeeper. It does not configure RPC or server-mode TLS for the HBase Indexer role. To configure TLS protocol versions, cipher suites, and server-mode TLS for the HBase Indexer, see Configure Lily HBase Indexer to use TLS/SSL.

The Enable TLS/SSL for HBase Indexer Zookeeper property is disabled by default. For the full set of Search ZooKeeper TLS properties to enable in Cloudera Manager, see Enabling ZooKeeper SSL/TLS for Solr and HBase Indexer.

The Enable TLS/SSL for ZooKeeper option must be enabled in the ZooKeeper configuration. This is a default setting for a secure cluster.
The Enable TLS/SSL for Solr Zookeeper must be selected for the Solr service used with HBase Indexer. When you disable TLS/SSL for HBase Indexer ZooKeeper, ensure that you disable it for the Solr service as well. See Enabling SSL for Solr ZooKeeper.
The HBase ZooKeeper Secure Client Enabled option must be enabled in the HBase configuration.

In Cloudera Manager, select the Key-Value Store Indexer service for which you want to enable secure ZooKeeper communication.
Click the Configuration tab.
Search for SSL.
Find the Enable TLS/SSL for HBase Indexer Zookeeper property and select it to enable TLS/SSL.
Click Save Changes.
Restart the Key-Value Store Indexer service and any dependent services.