跳到主要内容

With Kerberos

This page explains additional steps for using Kerberos authentication in Hive on MR3.

Kerberos keytabs​

In our example, we assume that orange1 is the host name assigned to the Services for HiveServer2, Ranger, and MR3-UI/Grafana, and that PL is the Kerberos realm.

Create a Kerberos keytab file for service principal hive/orange1@PL. In our example, we create a keytab file hive-orange1.keytab.

警告

The service name of the principal must be hive which is the value of DOCKER_USER in env.sh.

Create another keytab file with a user principal. In our example, we can create a keytab file hive.keytab for principal hive@PL.

Copy all keytab files in the directory hive/key.

ls hive/key/*.keytabhive/key/hive.keytab  hive/key/hive-orange1.keytab

For Ranger, create three Kerberos keytab files with exactly the following names and copy them in the directory ranger/key.

  • rangeradmin.keytab with admin service principal rangeradmin/orange1@PL
  • spnego.service.keytab with SPNEGO service principal HTTP/orange1@PL
  • rangerlookup.keytab with lookup principal rangerlookup@PL
ls ranger/key/*.keytabranger/key/rangeradmin.keytab  ranger/key/rangerlookup.keytab  ranger/key/spnego.service.keytab

hive/values-hive.yaml​

Update hive/values-hive.yaml as follows:

vi values-hive.yamlmetastore:  secureMode: true  kerberosPrincipal: hive/orange1@PL  kerberosKeytab: "hive-orange1.keytab"hive:  createSecret: true  authentication: KERBEROS  kerberosPrincipal: hive/orange1@PL  kerberosKeytab: "hive-orange1.keytab"
  • Since Metastore uses Kerberos authentication, set metastore/secureMode to true. metastore/kerberosPrincipal and metastore/kerberosKeytab specify the service principal and the service keytab file, respectively.
  • hive/createSecret specifies whether or not to create a Secret from files in the directory key and should be set to true.
  • Since HiveServer2 uses Kerberos authentication, set hive/authentication to KERBEROS. hive/kerberosPrincipal and hive/kerberosKeytab specify the service principal and the service keytab file, respectively.

To access HDFS, set the following variables.

vi hive/values-hive.yamlhdfs:  userPrincipal: hive@PL  userKeytab: "hive.keytab"  tokenRenewalEnabled: true
  • hdfs/userPrincipal specifies the principal to use when accessing HDFS.
  • hdfs/userKeytab specifies the name of the keytab file.
  • hdfs/tokenRenewalEnabled should be set to true in order to automatically renew HDFS tokens.

ranger/values-ranger.yaml​

Update ranger/values-ranger.yaml to create Secrets from files in the directories ranger-key.

vi ranger/values-ranger.yamlranger:  createSecret: true

Configuring Kerberos authentication​

Follow the instructions in Configuring Kerberos Authentication.