侧边栏壁纸
博主头像
落叶人生博主等级

走进秋风,寻找秋天的落叶

  • 累计撰写 144679 篇文章
  • 累计创建 28 个标签
  • 累计收到 9 条评论
标签搜索

目 录CONTENT

文章目录

Yarn配置kerberos认证

2023-12-23 星期六 / 0 评论 / 0 点赞 / 12 阅读 / 9813 字

1、环境说明 系统环境: 操作系统:centos6.6 Hadoop版本:CDH5.5 JDK版本:1.7.0_67 集群各节点Yarn的角色规划为: 172.16.57.74 bd-o

1、环境说明

系统环境:

  • 操作系统:centos6.6
  • Hadoop版本:CDH5.5
  • JDK版本:1.7.0_67

集群各节点Yarn的角色规划为:

172.16.57.74   bd-ops-test-74    ResourceManager  NodeManager172.16.57.75   bd-ops-test-75    ResourceManager  NodeManager172.16.57.76   bd-ops-test-76    NodeManager JobHistoryServer yarn-proxyserver172.16.57.77   bd-ops-test-77    NodeManager   

2、生成keytab

在 74 节点,即 KDC server 节点上执行下面命令:

cd /var/kerberos/krb5kdc/kadmin.local -q "addprinc -randkey yarn/[email protected] "kadmin.local -q "addprinc -randkey yarn/[email protected] "kadmin.local -q "addprinc -randkey yarn/[email protected] "kadmin.local -q "addprinc -randkey yarn/[email protected] "kadmin.local -q "addprinc -randkey mapred/[email protected] "kadmin.local -q "addprinc -randkey mapred/[email protected] "kadmin.local -q "addprinc -randkey mapred/[email protected] "kadmin.local -q "addprinc -randkey mapred/[email protected] "kadmin.local -q "xst  -k yarn.keytab  yarn/[email protected]"kadmin.local -q "xst  -k yarn.keytab  yarn/[email protected] "kadmin.local -q "xst  -k yarn.keytab  yarn/[email protected] "kadmin.local -q "xst  -k yarn.keytab  yarn/[email protected] "kadmin.local -q "xst  -k mapred.keytab  mapred/[email protected] "kadmin.local -q "xst  -k mapred.keytab  mapred/[email protected] "kadmin.local -q "xst  -k mapred.keytab  mapred/[email protected] "kadmin.local -q "xst  -k mapred.keytab  mapred/[email protected] "

拷贝 yarn.keytab 和 mapred.keytab 文件到其他节点的 /etc/hadoop/conf 目录

scp yarn.keytab mapred.keytab bd-ops-test-xx:/etc/hadoop/conf

并设置权限,在各节点上执行:

# cd /etc/hadoop/conf/;chown yarn:hadoop yarn.keytab;chown mapred:hadoop mapred.keytab ;chmod 400 *.keytab

由于 keytab 相当于有了永久凭证,不需要提供密码(如果修改 kdc 中的 principal 的密码,则该 keytab 就会失效),所以其他用户如果对该文件有读权限,就可以冒充 keytab 中指定的用户身份访问 hadoop,所以 keytab 文件需要确保只对 owner 有读权限(0400)

3. 修改 YARN 配置文件

修改 yarn-site.xml,添加下面配置:

<property>  <name>yarn.resourcemanager.keytab</name>  <value>/etc/hadoop/conf/yarn.keytab</value></property><property>  <name>yarn.resourcemanager.principal</name>   <value>yarn/[email protected]</value></property><property>  <name>yarn.nodemanager.keytab</name>  <value>/etc/hadoop/conf/yarn.keytab</value></property><property>  <name>yarn.nodemanager.principal</name>   <value>yarn/[email protected]</value></property> <property>  <name>yarn.nodemanager.container-executor.class</name>    <value>org.apache.hadoop.yarn.server.nodemanager.LinuxContainerExecutor</value></property> <property>  <name>yarn.nodemanager.linux-container-executor.group</name>  <value>yarn</value></property><property>   <name>yarn.web-proxy.keytab</name>   <value>/etc/hadoop/conf/yarn.keytab</value></property><property>    <name>yarn.web-proxy.principal</name>    <value>yarn/[email protected]</value></property>

修改 mapred-site.xml,添加如下配置:

<property>  <name>mapreduce.jobhistory.keytab</name>  <value>/etc/hadoop/conf/mapred.keytab</value></property> <property>  <name>mapreduce.jobhistory.principal</name>   <value>mapred/[email protected]</value></property>

/etc/hadoop/conf 目录下创建 container-executor.cfg 文件,内容如下:

#configured value of yarn.nodemanager.linux-container-executor.groupyarn.nodemanager.linux-container-executor.group=yarn#comma separated list of users who can not run applicationsbanned.users=bin#Prevent other super-usersmin.user.id=0#comma separated list of system users who CAN run applicationsallowed.system.users=root,nobody,impala,hive,hdfs,yarn

设置该文件权限:

# chown root:yarn container-executor.cfg# chmod 400 container-executor.cfg# ll container-executor.cfg-r-------- 1 root yarn 354 11-05 14:14 container-executor.cfg

注意:

  • container-executor.cfg 文件读写权限需设置为 400,所有者为 root:yarn
  • yarn.nodemanager.linux-container-executor.group 要同时配置在 yarn-site.xml 和 container-executor.cfg,且其值需要为运行 NodeManager 的用户所在的组,这里为 yarn。
  • banned.users 不能为空,默认值为 hfds,yarn,mapred,bin
  • min.user.id 默认值为 1000,在有些 centos 系统中,用户最小 id 为500,则需要修改该值
  • 确保 yarn.nodemanager.local-dirsyarn.nodemanager.log-dirs 对应的目录权限为 755

设置 /usr/lib/hadoop-yarn/bin/container-executor 读写权限为 6050 如下:

# chown root:yarn /usr/lib/hadoop-yarn/bin/container-executor# chmod 6050 /usr/lib/hadoop-yarn/bin/container-executor# ll /usr/lib/hadoop-yarn/bin/container-executor---Sr-s--- 1 root yarn 333 11-04 19:11 container-executor

测试是否配置正确:

# /usr/lib/hadoop-yarn/bin/container-executor --checksetup

如果提示错误,则查看 NodeManger 的日志,然后对照 YARN ONLY: Container-executor Error Codes 查看错误对应的问题说明。

关于 LinuxContainerExecutor 的详细说明,可以参考 http://hadoop.apache.org/docs/r2.5.0/hadoop-project-dist/hadoop-common/SecureMode.html#LinuxContainerExecutor。

记住将修改的上面文件同步到其他节点,并再次一一检查权限是否正确。

# cd /etc/hadoop/conf/# scp yarn-site.xml mapred-site.xml container-executor.cfg  bd-ops-test-xx:/etc/hadoop/conf/# cd /etc/hadoop/conf/; chown root:yarn container-executor.cfg ; chmod 400 container-executor.cfg# cd /etc/hadoop/conf/; chown root:yarn container-executor.cfg ; chmod 400 container-executor.cfg

4、启动服务

启动 ResourceManager

resourcemanager 是通过 yarn 用户启动的,故在 74,75 上先获取 yarn 用户的 ticket 再启动服务:

$ kinit -k -t /etc/hadoop/conf/yarn.keytab yarn/[email protected]# service hadoop-yarn-resourcemanager start

然后查看日志,确认是否启动成功。

2016-09-05 13:40:11,190 INFO org.apache.hadoop.yarn.server.resourcemanager.RMAuditLogger: USER=yarn	OPERATION=transitionToActive	TARGET=RMHAProtocolService	RESULT=SUCCESS

启动 NodeManager

resourcemanager 是通过 yarn 用户启动的,故在各节点上先获取 yarn 用户的 ticket 再启动服务:

kinit -k -t /etc/hadoop/conf/yarn.keytab yarn/[email protected] ;service hadoop-yarn-nodemanager start

观察日志成功信息:

2016-09-05 13:50:37,869 INFO org.apache.hadoop.security.UserGroupInformation: Login successful for user yarn/[email protected] using keytab file /etc/hadoop/conf/yarn.keytab

启动 MapReduce Job History Server

resourcemanager 是通过 mapred 用户启动的,故在 76节点 上先获取 mapred 用户的 ticket 再启动服务:

$ kinit -k -t /etc/hadoop/conf/mapred.keytab mapred/[email protected]# service hadoop-mapreduce-historyserver start

观察日志成功信息:

16/09/05 13:55:49 INFO security.UserGroupInformation: Login successful for user mapred/[email protected] using keytab file /etc/hadoop/conf/mapred.keytab

启动 yarn-proxyserver

# service hadoop-yarn-proxyserver start

观察日志成功信息:

2016-09-05 16:28:24,569 INFO org.apache.hadoop.security.UserGroupInformation: Login successful for user yarn/[email protected] using keytab file /etc/hadoop/conf/yarn.keytab

5. 测试

运行一个 mapreduce 的例子:

hadoop jar /usr/lib/hadoop-mapreduce/hadoop-mapreduce-examples.jar pi 10 10000

如果没有报错,则说明配置成功。最后运行的结果为:

Job Finished in 45.007 secondsEstimated value of Pi is 3.14120000000000000000

 

 

广告 广告

评论区