[AMBARI-7204] Ambari Automated Kerberization

• Type: Epic
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.0.0
• Component/s: ambari-server, security, stacks
• Labels: active-directory authentication kerberos mit-kerberos security stack

Environment

Kerberos

• Epic Name: Ambari Automated Kerberization
• Assignee: Robert Levas Assign to me
• Reporter: Robert Levas
• Created: 08/Sep/14 16:44
• Updated: 23/Mar/15 14:36
• Resolved: 17/Mar/15 19:36

Description

Problem
Manually installing and setting up Kerberos for a secure Hadoop cluster is error prone, largely manual and a potential source of configuration problems. It requires many steps where configuration files and credentials may need to be distributed across many nodes. Because of this the process is time consuming and lead to a high probability of user error.

The problem is exacerbated when the cluster is modified by adding or removing nodes and services.

Solution
Use Ambari to secure the cluster using Kerberos. By automating the process of setting up Kerberos, the repetitive tasks of distributing configuration details and credentials can be done in parallel to the nodes within the cluster. This also negates most user-related errors due to the lack of interaction a user has with the process.

See AmbariClusterKerberization.pdf for more details.

Issue Links

• is depended upon by: SLIDER-698 AM keytab creation and distribution in Ambari managed cluster
• requires: AMBARI-7985 Allow for server-side commands
• requires: AMBARI-8454 Create server-side actions to create kerberos principals and keytabs
• requires: AMBARI-7302 stacks API should provide information for features supported by a service or serviceComponent