devbox
weixin_40725706
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

hadoop 3.X 分布式HA集成Kerbos(保姆级教程）

作者：weixin_40725706 | 2024-07-07 05:06:57

赞

踩

hadoop 3.X 分布式HA集成Kerbos(保姆级教程）

前提：先安装Kerbos

1、创建keytab目录

在每台机器上上提前创建好对应的kertab目录

[hadoop@tv3-hadoop-01 ~]$ sudo mkdir -p /BigData/run/hadoop/keytab/

[hadoop@tv3-hadoop-01 ~]$ sudo mkdir -p /opt/security/

[hadoop@tv3-hadoop-01 ~]$ sudo chown hadoop:hadoop /BigData/run/hadoop/keytab/

[hadoop@tv3-hadoop-01 ~]$ ls -lrt /BigData/run/hadoop/

drwxr-xr-x 2 hadoop hadoop  4096 Jun 26 23:22 keytab

2、创建kerbos证书

进入管理机器，比如tv3-hadoop-01【本例中hadoop服务启动统一使用hadoop用户】

# 进入kadmin

[root@tv3-hadoop-01 ~]# kadmin.local

Authenticating as principal hadoop/admin@EXAMPLE.COM with password.

kadmin.local:  

# 查看用户

kadmin.local:  listprincs

# 创建用户

addprinc -randkey hadoop/tv3-hadoop-01@EXAMPLE.COM

3、证书添加

依次增加其他hdfs节点的验证，并导出到/BigData/run/hadoop/keytab/hadoop.keytab这个文件：

  1. addprinc -randkey hadoop/tv3-hadoop-01@EXAMPLE.COM
  2. addprinc -randkey hadoop/tv3-hadoop-02@EXAMPLE.COM
  3. addprinc -randkey hadoop/tv3-hadoop-03@EXAMPLE.COM
  4. addprinc -randkey hadoop/tv3-hadoop-04@EXAMPLE.COM
  5. addprinc -randkey hadoop/tv3-hadoop-05@EXAMPLE.COM
  6. addprinc -randkey hadoop/tv3-hadoop-06@EXAMPLE.COM
  7.  
  8. addprinc -randkey HTTP/tv3-hadoop-01@EXAMPLE.COM
  9. addprinc -randkey HTTP/tv3-hadoop-02@EXAMPLE.COM
  10. addprinc -randkey HTTP/tv3-hadoop-03@EXAMPLE.COM
  11. addprinc -randkey HTTP/tv3-hadoop-04@EXAMPLE.COM
  12. addprinc -randkey HTTP/tv3-hadoop-05@EXAMPLE.COM
  13. addprinc -randkey HTTP/tv3-hadoop-06@EXAMPLE.COM
  14.  
  15. ktadd -k /BigData/run/hadoop/keytab/hadoop.keytab hadoop/tv3-hadoop-01@EXAMPLE.COM
  16. ktadd -k /BigData/run/hadoop/keytab/hadoop.keytab hadoop/tv3-hadoop-02@EXAMPLE.COM
  17. ktadd -k /BigData/run/hadoop/keytab/hadoop.keytab hadoop/tv3-hadoop-03@EXAMPLE.COM
  18. ktadd -k /BigData/run/hadoop/keytab/hadoop.keytab hadoop/tv3-hadoop-04@EXAMPLE.COM
  19. ktadd -k /BigData/run/hadoop/keytab/hadoop.keytab hadoop/tv3-hadoop-05@EXAMPLE.COM
  20. ktadd -k /BigData/run/hadoop/keytab/hadoop.keytab hadoop/tv3-hadoop-06@EXAMPLE.COM
  21.  
  22. ktadd -k /BigData/run/hadoop/keytab/HTTP.keytab HTTP/tv3-hadoop-01@EXAMPLE.COM
  23. ktadd -k /BigData/run/hadoop/keytab/HTTP.keytab HTTP/tv3-hadoop-02@EXAMPLE.COM
  24. ktadd -k /BigData/run/hadoop/keytab/HTTP.keytab HTTP/tv3-hadoop-03@EXAMPLE.COM
  25. ktadd -k /BigData/run/hadoop/keytab/HTTP.keytab HTTP/tv3-hadoop-04@EXAMPLE.COM
  26. ktadd -k /BigData/run/hadoop/keytab/HTTP.keytab HTTP/tv3-hadoop-05@EXAMPLE.COM
  27. ktadd -k /BigData/run/hadoop/keytab/HTTP.keytab HTTP/tv3-hadoop-06@EXAMPLE.COM

4、权限修改&kertab同步

修改权限到hadoop启动用户，否则会有权限访问问题,并同步到其他hdfs所有服务的节点上（JN，DN，NN，RM，NM）

  1. su  - hadoop
  2.  
  3. sudo chown hadoop:hadoop /BigData/run/hadoop/keytab/*.keytab
  4.  
  5. scp /BigData/run/hadoop/keytab/hadoop.keytab  /BigData/run/hadoop/keytab/HTTP.keytab hadoop@tv3-hadoop-06:/BigData/run/hadoop/keytab

5、修改配置文件

5.1 hdfs-site.xml

  1.     <property>
  2.         <name>dfs.block.access.token.enable</name>
  3.         <value>true</value>
  4.         <description>Enable HDFS block access tokens for secure operations</description>
  5.     </property>
  6.  
  7.     <property>
  8.         <name>dfs.namenode.kerberos.principal</name>
  9.         <value>hadoop/_HOST@EXAMPLE.COM</value>
  10.         <description>namenode对应的kerberos账户为 nn/主机名@EXAMPLE.CPOM   _HOST会自动转换为主机名</description>
  11.     </property>
  12.  
  13.     <property>
  14.         <name>dfs.namenode.keytab.file</name>
  15.         <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  16.         <description>因为使用-randkey 创建的用户 密码随机不知道，所以需要用免密登录的keytab文件 指定namenode需要用的keytab文件在哪里</description>
  17.     </property>
  18.  
  19.     <property>
  20.         <name>dfs.namenode.kerberos.internal.spnego.principal</name>
  21.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  22.         <description>https 相关（如开启namenodeUI）使用的账户</description>
  23.     </property>
  24.  
  25.     <property>
  26.         <name>dfs.namenode.kerberos.internal.spnego.keytab</name>
  27.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  28.     </property>
  29.  
  30.    <property>
  31.         <name>dfs.secondary.namenode.kerberos.principal</name>
  32.         <value>hadoop/_HOST@EXAMPLE.COM</value>
  33.         <description>secondarynamenode使用的账户</description>
  34.     </property>
  35.     <property>
  36.         <name>dfs.secondary.namenode.keytab.file</name>
  37.         <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  38.         <description>sn对应的keytab文件</description>
  39.     </property>
  40.  
  41.     <property>
  42.         <name>dfs.secondary.namenode.kerberos.internal.spnego.principal</name>
  43.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  44.         <description>sn需要开启http页面用到的账户</description>
  45.     </property>
  46.      <property>
  47.         <name>dfs.secondary.namenode.kerberos.internal.spnego.keytab</name>
  48.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  49.     </property>
  50.  
  51.     <property>
  52.         <name>dfs.journalnode.kerberos.principal</name>
  53.         <value>hadoop/_HOST@EXAMPLE.COM</value>
  54.     </property>
  55.  
  56.     <property>
  57.         <name>dfs.journalnode.keytab.file</name>
  58.         <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  59.     </property>
  60.  
  61.     <property>
  62.         <name>dfs.journalnode.kerberos.internal.spnego.principal</name>
  63.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  64.     </property>
  65.        <property>
  66.         <name>dfs.journalnode.kerberos.internal.spnego.keytab</name>
  67.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  68.     </property>
  69.  
  70.     <property>
  71.         <name>dfs.encrypt.data.transfer</name>
  72.         <value>true</value>
  73.         <description>数据传输协议激活数据加密</description>
  74.     </property>
  75.     <property>
  76.         <name>dfs.datanode.kerberos.principal</name>
  77.         <value>hadoop/_HOST@EXAMPLE.COM</value>
  78.         <description>datanode用到的账户</description>
  79.     </property>
  80.     <property>
  81.         <name>dfs.datanode.keytab.file</name>
  82.         <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  83.         <description>datanode用到的keytab文件路径</description>
  84.     </property>
  85.  
  86.     <property>
  87.         <name>dfs.data.transfer.protection</name>
  88.         <value>integrity</value>
  89.     </property>
  90.  
  91.     <property>
  92.         <name>dfs.https.port</name>
  93.         <value>50470</value>
  94.     </property>
  95.  
  96.     <!-- required if hdfs support https -->
  97.     <property>
  98.         <name>dfs.http.policy</name>
  99.         <value>HTTPS_ONLY</value>
  100.     </property>
  101.  
  102.     <!-- WebHDFS security config -->
  103.     <property>
  104.         <name>dfs.web.authentication.kerberos.principal</name>
  105.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  106.         <description>web hdfs 使用的账户</description>
  107.     </property>
  108.     <property>
  109.         <name>dfs.web.authentication.kerberos.keytab</name>
  110.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  111.         <description>对应的keytab文件</description>
  112.      </property>

5.2 core-site.xml

  1.     <property>
  2.         <name>dfs.block.access.token.enable</name>
  3.         <value>true</value>
  4.         <description>Enable HDFS block access tokens for secure operations</description>
  5.     </property>
  6.  
  7.     <property>
  8.         <name>hadoop.security.authorization</name>
  9.         <value>true</value>
  10.         <description>是否开启hadoop的安全认证</description>
  11.     </property>
  12.     
  13.     <property>
  14.         <name>hadoop.security.authentication</name>
  15.         <value>kerberos</value>
  16.         <description>使用kerberos作为hadoop的安全认证方案</description>
  17.     </property>
  18.     <property>
  19.         <name>hadoop.rpc.protection</name>
  20.         <value>authentication</value>
  21.         <description>authentication : authentication only (default); integrity : integrity check in addition to authentication; privacy : data encryption in addition to integrity</description>
  22.     </property>
  23.     <property>
  24.         <name>hadoop.security.auth_to_local</name>
  25.         <value>
  26.             RULE:[2:$1@$0](hadoop@.*EXAMPLE.COM)s/.*/hadoop/
  27.             RULE:[2:$1@$0](HTTP@.*EXAMPLE.COM)s/.*/hadoop/
  28.             DEFAULT
  29.         </value>
  30.     </property>

5.3 yarn-site.xml

  1.     <property>
  2.         <name>hadoop.http.authentication.type</name>
  3.         <value>kerberos</value>
  4.     </property>
  5.  
  6.     <property>
  7.         <name>hadoop.http.filter.initializers</name>
  8.         <value>org.apache.hadoop.security.AuthenticationFilterInitializer</value>
  9.     </property>
  10.  
  11.     <property>
  12.         <name>yarn.resourcemanager.webapp.delegation-token-auth-filter.enabled</name>
  13.         <value>false</value>
  14.         <description>标记以启用使用RM身份验证筛选器覆盖默认kerberos身份验证筛选器以允许使用委派令牌进行身份验证（如果缺少令牌，则回退到kerberos）。仅适用于http身份验证类型为kerberos的情况。</description>
  15.     </property>
  16.  
  17.     <property>
  18.         <name>hadoop.http.authentication.kerberos.principal</name>
  19.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  20.     </property>
  21.  
  22.     <property>
  23.         <name>hadoop.http.authentication.kerberos.keytab</name>
  24.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  25.     </property>
  26.  
  27.     <property>
  28.         <name>yarn.acl.enable</name>
  29.         <value>true</value>
  30.     </property>
  31.  
  32.     <property>
  33.         <name>yarn.web-proxy.principal</name>
  34.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  35.     </property>
  36.  
  37.     <property>
  38.         <name>yarn.web-proxy.keytab</name>
  39.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  40.     </property>
  41.  
  42.     <property>
  43.         <name>yarn.resourcemanager.principal</name>
  44.         <value>hadoop/_HOST@EXAMPLE.COM</value>
  45.     </property>
  46.  
  47.     <property>
  48.         <name>yarn.resourcemanager.keytab</name>
  49.         <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  50.     </property>
  51.  
  52.     <!-- nodemanager -->
  53.     <property>
  54.         <name>yarn.nodemanager.principal</name>
  55.         <value>hadoop/_HOST@EXAMPLE.COM</value>
  56.     </property>
  57.     <property>
  58.         <name>yarn.nodemanager.keytab</name>
  59.         <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  60.     </property>
  61.     <property>
  62.         <name>yarn.nodemanager.container-executor.class</name>
  63.      
  64.  <value>org.apache.hadoop.yarn.server.nodemanager.LinuxContainerExecutor</value>
  65. </property>
  66.  
  67.     <property>
  68.         <name>yarn.nodemanager.linux-container-executor.group</name>
  69.         <value>hadoop</value>
  70.     </property>
  71.  
  72.     <property>
  73.         <name>yarn.nodemanager.linux-container-executor.path</name>
  74.         <value>/BigData/run/hadoop/bin/container-executor</value>
  75.     </property>
  76.  
  77.   <!-- webapp webapp configs -->
  78.     <property>
  79.         <name>yarn.resourcemanager.webapp.spnego-principal</name>
  80.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  81.     </property>
  82.     <property>
  83.         <name>yarn.resourcemanager.webapp.spnego-keytab-file</name>
  84.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  85.     </property>
  86.  
  87.     <property>
  88.         <name>yarn.timeline-service.http-authentication.type</name>
  89.         <value>kerberos</value>
  90.         <description>Defines authentication used for the timeline server HTTP endpoint. Supported values are: simple | kerberos | #AUTHENTICATION_HANDLER_CLASSNAME#</description>
  91.  
  92.     </property>
  93.     <property>
  94.         <name>yarn.timeline-service.principal</name>
  95.         <value>hadoop/_HOST@EXAMPLE.COM</value>
  96.     </property>
  97.  
  98.     <property>
  99.         <name>yarn.timeline-service.keytab</name>
  100.         <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  101.     </property>
  102.  
  103.     <property>
  104.         <name>yarn.timeline-service.http-authentication.kerberos.principal</name>
  105.         <value>HTTP/_HOST@EXAMPLE.COM</value>
  106.     </property>
  107.  
  108.     <property> 
  109.         <name>yarn.timeline-service.http-authentication.kerberos.keytab</name>
  110.         <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  111.     </property>
  112.  
  113.     <property>
  114.         <name>yarn.nodemanager.container-localizer.java.opts</name>
  115.         <value>-Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.krb5.realm=EXAMPLE.COM -Djava.security.krb5.kdc=tv3-hadoop-01:88</value>
  116.     </property>
  117.  
  118.     <property>
  119.         <name>yarn.nodemanager.health-checker.script.opts</name>
  120.         <value>-Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.krb5.realm=EXAMPLE.COM -Djava.security.krb5.kdc=tv3-hadoop-01:88</value>
  121.     </property>
  122.  
  123.     <property>
  124.         <name>yarn.nodemanager.linux-container-executor.nonsecure-mode.local-user</name>
  125.         <value>hadoop</value>
  126.     </property>
  127.     <property>
  128.         <name>yarn.nodemanager.linux-container-executor.group</name>
  129.         <value>hadoop</value>
  130.     </property>

5.4 mapred-site.xml

  1.  
  2. <property>
  3.     <name>mapreduce.map.java.opts</name>
  4.     <value>-Xmx1638M -Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.krb5.realm=EXAMPLE.COM -Djava.security.krb5.kdc=tv3-hadoop-01:88</value>
  5. </property>
  6.  
  7. <property>
  8.     <name>mapreduce.reduce.java.opts</name>
  9.     <value>-Xmx3276M -Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.krb5.realm=EXAMPLE.COM -Djava.security.krb5.kdc=tv3-hadoop-01:88</value>
  10. </property>
  11.  
  12. <property>
  13.     <name>mapreduce.jobhistory.keytab</name>
  14.     <value>/BigData/run/hadoop/keytab/hadoop.keytab</value>
  15. </property>
  16.  
  17. <property>
  18.     <name>mapreduce.jobhistory.principal</name>
  19.     <value>hadoop/_HOST@EXAMPLE.COM</value>
  20. </property>
  21.  
  22. <property>
  23.     <name>mapreduce.jobhistory.webapp.spnego-keytab-file</name>
  24.     <value>/BigData/run/hadoop/keytab/HTTP.keytab</value>
  25. </property>
  26.  
  27. <property>
  28.     <name>mapreduce.jobhistory.webapp.spnego-principal</name>
  29.     <value>HTTP/_HOST@EXAMPLE.COM</value>
  30. </property>

5.5 配置文件同步到各个节点

  1. cd /BigData/run/hadoop/etc/hadoop
  2. scp hdfs-site.xml  yarn-site.xml core-site.xml mapred-site.xml hadoop@tv3-hadoop-06:/BigData/run/hadoop/etc/hadoop/

6、配置SSL（开启https）

6.1 创建https证书(需要在每台机器上执行)
 

[hadoop@tv3-hadoop-01 hadoop]# mkdir -p /opt/security/kerberos_https

[hadoop@tv3-hadoop-01 hadoop]# cd /opt/security/kerberos_https

6.2 在任意一个hadoop节点生成CA证书

  1. [root@tv3-hadoop-01 kerberos_https]# openssl req -new -x509 -keyout hdfs_ca_key -out hdfs_ca_cert -days 9999 -subj /C=CN/ST=shanxi/L=xian/O=hlk/OU=hlk/CN=tv3-hadoop01
  2. Generating a 2048 bit RSA private key
  3. ...........................................................................................+++
  4. .................................................................................+++
  5. writing new private key to 'hdfs_ca_key'
  6. Enter PEM pass phrase:
  7. Verifying - Enter PEM pass phrase:
  8. -----
  9. [root@tv3-hadoop-01 kerberos_https]# ls -lrt 
  10. total 8
  11. -rw-r--r-- 1 root root 1834 Jun 29 09:45 hdfs_ca_key
  12. -rw-r--r-- 1 root root 1302 Jun 29 09:45 hdfs_ca_cert

6.3 将上面生成的CA 证书发送到每个节点上

  1.  
  2. scp -r /opt/security/kerberos_https root@tv3-hadoop-06:/opt/security/
  3.

 6.4 在每个hadoop节点上制作证书

  1. cd /opt/security/kerberos_https
  2.    
  3.    # 所有需要输入密码的地方全部输入123456（方便起见，如果你对密码有要求请自行修改）
  4.    
  5.    # 1  输入密码和确认密码：123456，此命令成功后输出keystore文件
  6.    
  7.      name="CN=$HOSTNAME, OU=hlk, O=hlk, L=xian, ST=shanxi, C=CN"
  8.    #需要输入第一步输入的密码四次
  9.      keytool -keystore keystore -alias localhost -validity 9999 -genkey -keyalg RSA -keysize 2048 -dname "$name"
  10.    
  11.    # 2 输入密码和确认密码：123456，提示是否信任证书：输入yes，此命令成功后输出truststore文件
  12.      keytool -keystore truststore -alias CARoot -import -file hdfs_ca_cert
  13.    
  14.    # 3 输入密码和确认密码：123456，此命令成功后输出cert文件
  15.      keytool -certreq -alias localhost -keystore keystore -file cert
  16.    
  17.    # 4 此命令成功后输出cert_signed文件
  18.      openssl x509 -req -CA hdfs_ca_cert -CAkey hdfs_ca_key -in cert -out cert_signed -days 9999 -CAcreateserial
  19.    
  20.    # 5 输入密码和确认密码：123456，是否信任证书，输入yes，此命令成功后更新keystore文件
  21.      keytool -keystore keystore -alias CARoot -import -file hdfs_ca_cert
  22.      keytool -keystore keystore -alias localhost -import -file cert_signed
  23.    
  24.    
  25.  
  26. [root@tv3-hadoop-06 kerberos_https]# ls -lrt
  27. total 28
  28. -rw-r--r-- 1 root root 1302 Jun 29 09:57 hdfs_ca_cert
  29. -rw-r--r-- 1 root root 1834 Jun 29 09:57 hdfs_ca_key
  30. -rw-r--r-- 1 root root  984 Jun 29 10:03 truststore
  31. -rw-r--r-- 1 root root 1085 Jun 29 10:03 cert
  32. -rw-r--r-- 1 root root   17 Jun 29 10:04 hdfs_ca_cert.srl
  33. -rw-r--r-- 1 root root 1188 Jun 29 10:04 cert_signed
  34. -rw-r--r-- 1 root root 4074 Jun 29 10:04 keystore

6.5 修改SSL server文件

在${HADOOP_HOME}/etc/hadoop目录构建ssl-server.xml文件

  1. <configuration>
  2.  
  3.     <property>
  4.         <name>ssl.server.truststore.location</name>
  5.         <value>/opt/security/kerberos_https/truststore</value>
  6.         <description>Truststore to be used by NN and DN. Must be specified.</description>
  7.     </property>
  8.  
  9.     <property>
  10.         <name>ssl.server.truststore.password</name>
  11.         <value>123456</value>
  12.         <description>Optional. Default value is "". </description>
  13.     </property>
  14.  
  15.     <property>
  16.         <name>ssl.server.truststore.type</name>
  17.         <value>jks</value>
  18.         <description>Optional. The keystore file format, default value is "jks".</description>
  19.     </property>
  20.  
  21.     <property>
  22.         <name>ssl.server.truststore.reload.interval</name>
  23.         <value>10000</value>
  24.         <description>Truststore reload check interval, in milliseconds. Default value is 10000 (10 seconds). </description>
  25.     </property>
  26.  
  27.     <property>
  28.         <name>ssl.server.keystore.location</name>
  29.         <value>/opt/security/kerberos_https/keystore</value>
  30.         <description>Keystore to be used by NN and DN. Must be specified.</description>
  31.     </property>
  32.  
  33.     <property>
  34.         <name>ssl.server.keystore.password</name>
  35.         <value>123456</value>
  36.         <description>Must be specified.</description>
  37.     </property>
  38.  
  39.     <property>
  40.         <name>ssl.server.keystore.keypassword</name>
  41.         <value>123456</value>
  42.         <description>Must be specified.</description>
  43.     </property>
  44.  
  45.     <property>
  46.         <name>ssl.server.keystore.type</name>
  47.         <value>jks</value>
  48.         <description>Optional. The keystore file format, default value is "jks".</description>
  49.     </property>
  50.  
  51.     <property>
  52.         <name>ssl.server.exclude.cipher.list</name>
  53.         <value>TLS_ECDHE_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
  54.         SSL_RSA_WITH_DES_CBC_SHA,SSL_DHE_RSA_WITH_DES_CBC_SHA,
  55.         SSL_RSA_EXPORT_WITH_RC4_40_MD5,SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,
  56.         SSL_RSA_WITH_RC4_128_MD5</value>
  57.         <description>Optional. The weak security cipher suites that you want excludedfrom SSL communication.</description>
  58.     </property>
  59.    
  60. </configuration>

6.6 修改SSL-client文件

  1. <configuration>
  2.  
  3.     <property>
  4.         <name>ssl.client.truststore.location</name>
  5.         <value>/opt/security/kerberos_https/truststore</value>
  6.         <description>Truststore to be used by clients like distcp. Must be specified.  </description>
  7.     </property>
  8.  
  9.     <property>
  10.         <name>ssl.client.truststore.password</name>
  11.         <value>123456</value>
  12.         <description>Optional. Default value is "". </description>
  13.     </property>
  14.  
  15.     <property>
  16.         <name>ssl.client.truststore.type</name>
  17.         <value>jks</value>
  18.         <description>Optional. The keystore file format, default value is "jks".</description>
  19.     </property>
  20.  
  21.     <property>
  22.         <name>ssl.client.truststore.reload.interval</name>
  23.         <value>10000</value>
  24.         <description>Truststore reload check interval, in milliseconds. Default value is 10000 (10 seconds). </description>
  25.     </property>
  26.  
  27.     <property>
  28.         <name>ssl.client.keystore.location</name>
  29.         <value>/opt/security/kerberos_https/keystore</value>
  30.         <description>Keystore to be used by clients like distcp. Must be   specified.   </description>
  31.     </property>
  32.  
  33.     <property>
  34.         <name>ssl.client.keystore.password</name>
  35.         <value>123456</value>
  36.         <description>Optional. Default value is "". </description>
  37.     </property>
  38.  
  39.     <property>
  40.         <name>ssl.client.keystore.keypassword</name>
  41.         <value>123456</value>
  42.         <description>Optional. Default value is "". </description>
  43.     </property>
  44.  
  45.     <property>
  46.         <name>ssl.client.keystore.type</name>
  47.         <value>jks</value>
  48.         <description>Optional. The keystore file format, default value is "jks". </description>
  49.     </property>
  50.     
  51. </configuration>

6.7 hdfs配置HTTPS（修改后需要同步到每个节点）

  1.   <property>
  2.            <name>dfs.http.policy</name>
  3.            <value>HTTPS_ONLY</value>
  4.            <description>所有开启的web页面均使用https, 细节在ssl server 和client那个配置文件内配置</description>
  5.        </property>

7、启动hadoop基础测试

7.1 HA模式启动顺序

建议依次启动JN、NN、ZKFC、DN、RM、NM服务

7.2 启动JN(每个服务启动之前需要init单独的节点）

  1. kinit -kt /BigData/run/hadoop/keytab/hadoop.keytab hadoop/$HOSTNAME@EXAMPLE.COM
  2. ##重启JournalNode
  3.  
  4. hadoop-daemon.sh stop journalnode && hadoop-daemon.sh start journalnode
  5.  
  6. ##启动JournalNode
  7.  
  8. hadoop-daemon.sh start journalnode
  9.  
  10. ##停止JournalNode
  11.  
  12. hadoop-daemon.sh stop journalnode
  13.

7.3 启动NameNode和ZKFC服务

如果是新集群，需要提前format

hadoop namenode -format
  1. kinit -kt /BigData/run/hadoop/keytab/hadoop.keytab hadoop/$HOSTNAME@EXAMPLE.COM
  2. ##重启nn
  3.  
  4. hadoop-daemon.sh stop namenode && hadoop-daemon.sh start namenode
  5.  
  6. ##启动nn
  7.  
  8. hadoop-daemon.sh start namenode
  9.  
  10. ##停止nn
  11.  
  12. hadoop-daemon.sh stop namenode
  13.  
  14.  
  15. ##重启zkfc
  16.  
  17. hadoop-daemon.sh stop zkfc && hadoop-daemon.sh start zkfc
  18.  
  19. ##启动zkfc
  20.  
  21. hadoop-daemon.sh start zkfc
  22.  
  23. ##停止zkfc
  24.  
  25. hadoop-daemon.sh stop zkfc

7.4 启动DatanNode服务

  1. kinit -kt /BigData/run/hadoop/keytab/hadoop.keytab hadoop/$HOSTNAME@EXAMPLE.COM
  2. ##重启dn
  3.  
  4. hadoop-daemon.sh stop datanode && hadoop-daemon.sh start datanode
  5.  
  6. ##启动dn
  7.  
  8. hadoop-daemon.sh start datanode
  9.  
  10. ##停止dn
  11.  
  12. hadoop-daemon.sh stop datanode

7.5 验证HA功能(多NameNode)

[hadoop@tv3-hadoop-01 hadoop]$ hdfs haadmin -failover nn2 nn1

7.6 验证HDFS文件读写

  1. [hadoop@tv3-hadoop-01 ~]$ echo '123' > b
  2. [hadoop@tv3-hadoop-01 ~]$ hdfs dfs -put -f b /tmp/
  3. [hadoop@tv3-hadoop-01 ~]$ hdfs dfs -cat /tmp/b
  4. 123
  5. [hadoop@tv3-hadoop-01 ~]$

7.7 启动HTTPS后 webui无法访问UI状态

7.8 启动Resoucemanager服务

  1. kinit -kt /BigData/run/hadoop/keytab/hadoop.keytab hadoop/$HOSTNAME@EXAMPLE.COM
  2. ##重启rm
  3.  
  4. yarn --daemon stop resourcemanager && yarn --daemon start resourcemanager
  5.  
  6. ##启动rm
  7.  
  8. yarn --daemon start resourcemanager
  9.  
  10. ##停止rm
  11.  
  12. yarn --daemon stop resourcemanager

7.9. 启动Nodemanager服务

  1. kinit -kt /BigData/run/hadoop/keytab/hadoop.keytab hadoop/$HOSTNAME@EXAMPLE.COM
  2. ##重启rm
  3.  
  4. yarn --daemon stop nodemanager && yarn --daemon start nodemanager
  5. ##启动rm
  6.  
  7. yarn --daemon start nodemanager
  8.  
  9. ##停止rm
  10.  
  11. yarn --daemon stop nodemanager

7.10 验证Mapreduce job

hadoop jar /BigData/run/hadoop/share/hadoop/mapreduce/hadoop-mapreduce-examples-3.3.1.jar pi 5 10

看到下面结果代表YARN已经部署ok

  1. Job Finished in 66.573 seconds
  2. Estimated value of Pi is 3.28000000000000000000
  3. [hadoop@tv3-hadoop-01 hadoop]$
声明：本文内容由网友自发贡献，转载请注明出处：【wpsshop】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号