Skip to content

Commit 559749a

Browse files
tristanGitHub Enterprise
tristan
authored and
GitHub Enterprise
committed
Kerberos, TLS and Database updates (#177)
1 parent 69e27fc commit 559749a

File tree

13 files changed

+150
-27
lines changed

13 files changed

+150
-27
lines changed

‎nifi_workaround.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Copyright 2021 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
17+
- name: Setup symlinks for NiFi TLS keystore and truststore
18+
hosts: cluster
19+
become: yes
20+
gather_facts: no
21+
tasks:
22+
- name: Perform the NiFi workaround for explicit TLS
23+
block:
24+
25+
- name: Ensure the NiFi home directory exists
26+
file:
27+
path: /var/lib/nifi
28+
owner: nifi
29+
group: nifi
30+
state: directory
31+
32+
- name: Ensure the link for the NiFi keystore exists
33+
file:
34+
src: "{{ tls_keystore_path }}"
35+
dest: /var/lib/nifi/cm-auto-host_keystore.jks
36+
state: link
37+
38+
- name: Ensure the link for the NiFi truststore exists
39+
file:
40+
src: "{{ tls_truststore_path }}"
41+
dest: /var/lib/nifi/cm-auto-in_cluster_truststore.jks
42+
state: link
43+
44+
- name: Ensure the NiFi Registry home directory exists
45+
file:
46+
path: /var/lib/nifiregistry
47+
owner: nifiregistry
48+
group: nifiregistry
49+
state: directory
50+
51+
- name: Ensure the link for the NiFi Registry keystore exists
52+
file:
53+
src: "{{ tls_keystore_path }}"
54+
dest: /var/lib/nifiregistry/cm-auto-host_keystore.jks
55+
state: link
56+
57+
- name: Ensure the link for the NiFi Registry truststore exists
58+
file:
59+
src: "{{ tls_truststore_path }}"
60+
dest: /var/lib/nifiregistry/cm-auto-in_cluster_truststore.jks
61+
state: link
62+
63+
when: >
64+
(tls | default(False)
65+
or manual_tls_cert_distribution | default(False))
66+
and not (autotls | default(False))

‎roles/cloudera_manager/common/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,5 +23,6 @@ cloudera_manager_database_type: "{{ database_type }}"
2323
cloudera_manager_database_name: scm
2424
cloudera_manager_database_user: scm
2525
cloudera_manager_database_password: changeme
26+
cloudera_manager_database_port: "{{ database_type | default_database_port }}"
2627
cloudera_manager_agent_lib_directory: /var/lib/cloudera-scm-agent
2728
cloudera_manager_cmf_java_opts_default: "-Xmx4G -XX:MaxPermSize=256m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp"

‎roles/cloudera_manager/database/tasks/external.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666

6767
- name: Prepare Cloudera Manager Server external database
6868
command: |
69-
{{ cloudera_manager_database_prepare_script }} -f --host {{ cloudera_manager_database_host }}
69+
{{ cloudera_manager_database_prepare_script }} -f --host {{ cloudera_manager_database_host }} --port {{ cloudera_manager_database_port }}
7070
{{ cloudera_manager_database_type | regex_replace('mariadb', 'mysql') }}
7171
{{ cloudera_manager_database_name }}
7272
{{ cloudera_manager_database_user }}

‎roles/cloudera_manager/kerberos/templates/kerberos_configs.j2‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,3 @@ AD_DELETE_ON_REGENERATE: {{ krb5_kdc_active_directory_delete_on_regenerate | def
88
KDC_ACCOUNT_CREATION_HOST_OVERRIDE: {{ krb5_kdc_account_creation_host_override | default(None) }}
99
AD_SET_ENCRYPTION_TYPES: {{ krb5_kdc_active_directory_set_encryption_types | default('false') }}
1010
GEN_KEYTAB_SCRIPT: {{ krb5_keytab_retrieval_script | default(None) }}
11-
KRB_AUTH_ENABLE: {{ krb5_cm_auth_enable | default('false') }}
12-

‎roles/config/cluster/base/templates/configs/ldap.j2‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ HUE:
7070
group_filter: "(objectClass={{ auth_provider.ldap_object_class.group }})"
7171
group_member_attr: "{{ auth_provider.ldap_attribute.member }}"
7272
group_name_attr: "{{ auth_provider.ldap_attribute.group }}"
73-
ldap_cert: "{{ auth_provider.ldap_cert | default('') }}"
73+
ldap_cert: "{{ auth_provider.ldap_cert | default(tls_chain_path) }}"
7474
ldap_url: "{{ auth_provider.ldap_url }}"
7575
search_bind_authentication: true
7676
use_start_tls: true
@@ -90,6 +90,31 @@ HUE:
9090
# SERVICEWIDE:
9191
# ldap.auth.url:
9292
# ldap.auth.user.dn.template:
93+
NIFI:
94+
NIFI_NODE:
95+
nifi.ldap.authentication.strategy: LDAPS
96+
nifi.ldap.enabled: true
97+
nifi.ldap.manager.dn: "{{ auth_provider.ldap_bind_user_dn }}"
98+
nifi.ldap.manager.password: "{{ auth_provider.ldap_bind_password }}"
99+
nifi.ldap.tls.client.auth: NONE
100+
nifi.ldap.tls.truststore: "{{ tls_truststore_path }}"
101+
nifi.ldap.tls.truststore.password: "{{ tls_truststore_password }}"
102+
nifi.ldap.tls.truststore.type: jks
103+
nifi.ldap.url: "{{ auth_provider.ldap_url }}"
104+
nifi.ldap.user.search.base: "{{ auth_provider.ldap_search_base.user }}"
105+
nifi.ldap.tls.protocol: TLS
106+
xml.authorizers.userGroupProvider.file-user-group-provider.enabled: false
107+
xml.authorizers.authorizer.ranger-provider.property.User Group Provider: composite-user-group-provider
108+
xml.authorizers.userGroupProvider.composite-configurable-user-group-provider.enabled: false
109+
xml.authorizers.userGroupProvider.composite-user-group-provider.enabled: true
110+
xml.authorizers.userGroupProvider.composite-user-group-provider.property.User Group Provider 1: ldap-user-group-provider
111+
xml.authorizers.userGroupProvider.composite-user-group-provider.property.User Group Provider 2: cm-user-group-provider
112+
xml.authorizers.userGroupProvider.ldap-user-group-provider.property.Group Member Attribute: "{{ auth_provider.ldap_attribute.member }}"
113+
xml.authorizers.userGroupProvider.ldap-user-group-provider.property.Group Name Attribute: "{{ auth_provider.ldap_attribute.group }}"
114+
xml.authorizers.userGroupProvider.ldap-user-group-provider.property.Group Object Class: "{{ auth_provider.ldap_object_class.group }}"
115+
xml.authorizers.userGroupProvider.ldap-user-group-provider.property.Group Search Base: "{{ auth_provider.ldap_search_base.group }}"
116+
xml.authorizers.userGroupProvider.ldap-user-group-provider.property.User Group Name Attribute: "{{ auth_provider.ldap_attribute.user_member }}"
117+
xml.authorizers.userGroupProvider.ldap-user-group-provider.property.User Identity Attribute: "{{ auth_provider.ldap_attribute.user }}"
93118
#RANGER:
94119
# RANGER_ADMIN:
95120
# ranger.ldap.ad.base.dn:

‎roles/config/cluster/base/templates/configs/tls.j2‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,8 @@ KS_INDEXER:
123123
keystore_indexer_truststore_password: {{ tls_truststore_password }}
124124
KUDU:
125125
KUDU_MASTER:
126+
ssl_client_truststore_location: {{ tls_truststore_path }}
127+
ssl_client_truststore_password: {{ tls_truststore_password }}
126128
ssl_enabled: True
127129
ssl_server_ca_certificate_location: {{ tls_chain_path }}
128130
ssl_server_certificate_location: {{ tls_cert_path_generic }}

‎roles/config/cluster/base/templates/configs/trusted-realms.j2‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
{% set additional_realms = auth_providers | default({}) | dict2items | json_query('[?value.type == `KERBEROS`].value.krb5_realm') %}
3+
CORE_SETTINGS:
4+
SERVICEWIDE:
5+
trusted_realms: "{{ ','.join([krb5_realm] + additional_realms) }}"
6+
HDFS:
7+
SERVICEWIDE:
8+
trusted_realms: "{{ ','.join([krb5_realm] + additional_realms) }}"
9+
KAFKA:
10+
KAFKA_BROKER:
11+
kafka.properties_role_safety_valve: |
12+
sasl.kerberos.principal.to.local.rules={% for trusted_realm in additional_realms %}RULE:[1:$1@$0](.*@{{ trusted_realm|upper }})s/@{{ trusted_realm|upper }}// , RULE:[2:$1@$0](.*@{{ trusted_realm|upper }})s/@{{ trusted_realm|upper }}// , {% endfor %}DEFAULT

‎roles/config/cluster/base/vars/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ custom_config_templates:
4141
condition: "{{ cluster.security.kerberos | default(False) and (cloudera_manager_version is version('6.0.0','<') or cluster.type | default('base') == 'compute') }}"
4242
- template: configs/kerberos-6.x-7.x.j2
4343
condition: "{{ cluster.security.kerberos | default(False) and cloudera_manager_version is version('6.0.0','>=') }}"
44+
- template: configs/trusted-realms.j2
45+
condition: "{{ cluster.security.kerberos | default(False) and auth_providers | default({}) | dict2items | json_query('[?value.type == `KERBEROS`]') | length > 0 }}"
4446
# Custom configurations for TLS
4547
- template: configs/tls.j2
4648
condition: "{{ cluster.security.tls | default(False) }}"

‎roles/prereqs/oracle_connector/tasks/main.yml‎

Lines changed: 29 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,37 @@
1414

1515
---
1616

17-
- name: Download Oracle Connector
18-
maven_artifact:
19-
group_id: "{{ oracle_connector_group_id }}"
20-
artifact_id: "{{ oracle_connector_artifact_id }}"
21-
version: "{{ oracle_connector_version }}"
22-
dest: "{{ local_temp_dir }}/{{ oracle_connector_artifact_id }}-connector-java-{{ oracle_connector_version }}.jar"
23-
repository_url: "{{ oracle_connector_maven_url }}"
24-
become: no
25-
run_once: true
26-
connection: local
27-
delegate_to: localhost
17+
- name: Setup the Oracle JDBC Driver
18+
block:
2819

29-
- name: Create /usr/share/java directory
30-
file:
31-
path: /usr/share/java
32-
state: directory
33-
mode: 0755
20+
- name: Download Oracle Connector
21+
maven_artifact:
22+
group_id: "{{ oracle_connector_group_id }}"
23+
artifact_id: "{{ oracle_connector_artifact_id }}"
24+
version: "{{ oracle_connector_version }}"
25+
dest: "{{ local_temp_dir }}/{{ oracle_connector_artifact_id }}-connector-java-{{ oracle_connector_version }}.jar"
26+
repository_url: "{{ oracle_connector_maven_url }}"
27+
become: no
28+
run_once: true
29+
connection: local
30+
delegate_to: localhost
3431

35-
- name: Copy Oracle Connector jar file to correct location
36-
copy:
37-
src: "{{ local_temp_dir }}/{{ oracle_connector_artifact_id }}-connector-java-{{ oracle_connector_version }}.jar"
38-
dest: /usr/share/java/oracle-connector-java.jar
39-
mode: 0644
32+
- name: Create /usr/share/java directory
33+
file:
34+
path: /usr/share/java
35+
state: directory
36+
mode: 0755
37+
38+
- name: Copy Oracle Connector jar file to correct location
39+
copy:
40+
src: "{{ local_temp_dir }}/{{ oracle_connector_artifact_id }}-connector-java-{{ oracle_connector_version }}.jar"
41+
dest: /usr/share/java/oracle-connector-java.jar
42+
mode: 0644
43+
44+
when:
45+
- not (skip_oracle_jdbc_driver_distribution | default(False))
46+
- oracle_connector_maven_url is defined
47+
- oracle_connector_maven_url != ''
4048

4149
- name: Ensure directory for the instantclient
4250
file:

‎roles/prereqs/os/tasks/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
loop: "{{ kernel_flags }}"
3535
loop_control:
3636
loop_var: flag
37-
when: "'root.hwx.site' not in ansible_domain"
37+
when: not(ansible_virtualization_type == "docker" and ansible_virtualization_role == "guest")
3838

3939
- name: Populate service facts
4040
service_facts:
@@ -100,4 +100,4 @@
100100
- name: Apply OS-specific configurations
101101
include_tasks:
102102
file: "main-{{ ansible_os_family }}.yml"
103-
when: "'root.hwx.site' not in ansible_domain"
103+
when: not(ansible_virtualization_type == "docker" and ansible_virtualization_role == "guest")

0 commit comments

Comments
 (0)