系統: LXC - CentOS6.3 x86_64
hadoop版本: cdh5.0.1(manmual安裝,未安裝cloudera-manager相關)
集羣現有環境:node*6;jdk1.7.0_55;已安裝zookeeper、hdfs(HA)、yarn、historyserver和httpfs並已開啓kerberos(kdc部署在cluster的一個節點上)。
所需安裝的包:所有節點-> yum install hbase 主節點-> yum install hbase-master hbase-thrift hbase-rest 從節點-> yum install hbase-regionserver
所需修改的配置文件如下:
主配置文件及內容: /etc/hbase/conf/hbase-site.xml
<configuration>
<property>
<name>hbase.cluster.distributed</name>
<value>true</value>
</property>
<property>
<name>hbase.rootdir</name>
<value>hdfs://irs-hdp-HA/hbase</value>
</property>
<property>
<name>hbase.rest.port</name>
<value>60050</value>
</property>
<property>
<name>hbase.zookeeper.quorum</name>
<value>cdh01.hypers.com,cdh02.hypers.com,cdh03.hypers.com</value>
</property>
<property>
<name>hbase.replication</name>
<value>true</value>
</property>
<property>
<name>hbase.security.authorization</name>
<value>true</value>
</property>
<property>
<name>hbase.coprocessor.master.classes</name>
<value>org.apache.hadoop.hbase.security.access.AccessController</value>
</property>
<property>
<name>hbase.coprocessor.region.classes</name>
<value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
</property>
<property>
<name>hbase.security.authentication</name>
<value>kerberos</value>
</property>
<property>
<name>hbase.rpc.engine</name>
<value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
</property>
<property>
<name>hbase.regionserver.kerberos.principal</name>
<value>hbase/[email protected]</value>
</property>
<property>
<name>hbase.regionserver.keytab.file</name>
<value>/etc/hadoop/conf/hbase.keytab</value>
</property>
<property>
<name>hbase.master.kerberos.principal</name>
<value>hbase/[email protected]</value>
</property>
<property>
<name>hbase.master.keytab.file</name>
<value>/etc/hadoop/conf/hbase.keytab</value>
</property>
<property>
<name>hbase.thrift.keytab.file</name>
<value>/etc/hadoop/conf/hbase.keytab</value>
</property>
<property>
<name>hbase.thrift.kerberos.principal</name>
<value>hbase/[email protected]</value>
</property>
<property>
<name>hbase.rest.keytab.file</name>
<value>/etc/hadoop/conf/hbase.keytab</value>
</property>
<property>
<name>hbase.rest.kerberos.principal</name>
<value>hbase/[email protected]</value>
</property>
<property>
<name>hbase.rest.authentication.type</name>
<value>kerberos</value>
</property>
<property>
<name>hbase.rest.authentication.kerberos.principal</name>
<value>HTTP/[email protected]</value>
</property>
<property>
<name>hbase.rest.authentication.kerberos.keytab</name>
<value>/etc/hadoop/conf/hbase.keytab</value>
</property>
</configuration>
安全相關配置文件 /etc/hbase/conf/zk-jaas.conf
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
useTicketCache=false
keyTab="/etc/hadoop/conf/hbase.keytab"
principal="hbase/[email protected]";
};
hbase相關的環境變量文件: /etc/hbase/conf/hbase-env.sh
export HBASE_OPTS="-XX:+UseConcMarkSweepGC"
export HBASE_OPTS="$HBASE_OPTS -Djava.security.auth.login.config=/etc/hbase/conf/zk-jaas.conf"
export HBASE_MANAGES_ZK=false
zookeeper配置文件(僅末尾兩行是hbase配置所需追加的): /usr/lib/zookeeper/conf/zoo.cfg
maxClientCnxns=50
tickTime=2000
initLimit=5
syncLimit=2
dataDir=/var/lib/zookeeper
clientPort=2181
server.1=cdh01.hypers.com:2888:3888
server.2=cdh02.hypers.com:2888:3888
server.3=cdh03.hypers.com:2888:3888
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000
kerberos.removeHostFromPrincipal=true
kerberos.removeRealmFromPrincipal=true
參考文檔說明(hortonworks會簡稱hdp;cloudera則cdh):
1、系統模板創建,由於筆者在openvz官方搜到的是centos6.5的模板,由於之前在測試環境時儘量和生產保持一致,因此要使用CentOS6.3,所以,筆記根據官方文檔自動,自行創建了一個模板,鏈接如下:http://openvz.org/Creating_a_CentOS_6_Template
2、安裝集羣參考的cdh官方文檔:http://www.cloudera.com/content/cloudera-content/cloudera-docs/CDH5/latest/CDH5-Installation-Guide/CDH5-Installation-Guide.html
3、kerberos和hadoop的整合階段大量參考了hortonworks的文檔,因爲cloudera的文檔給筆者的感覺就是假設這些都是OK的(簡直喪心病狂...),具體鏈接如下:
hortonworks的kerberos配置鏈接:http://docs.hortonworks.com/HDPDocuments/Ambari-1.6.1.0/bk_ambari_security/content/index.html
cloudera的kerberos配置鏈接:http://www.cloudera.com/content/cloudera-content/cloudera-docs/CDH5/latest/CDH5-Security-Guide/CDH5-Security-Guide.html
kerberos官網:http://web.mit.edu/kerberos/krb5-latest/doc/
4、本次主要參考cloudera的文檔及hbase官方文檔(因爲在安裝thrift和rest時,cdh未提及相關配置導致無法啓動...),相關鏈接如下:
cdh的hbase和kerberos部署整合的文檔:http://www.cloudera.com/content/cloudera-content/cloudera-docs/CDH5/latest/CDH5-Security-Guide/cdh5sg_hbase_security.html