3-Node NiFi 2.7.2 Standalone Cluster Setup Guide

ODP NiFi 2.7.2

Example Values

All hostnames, IPs, paths, and credentials shown below are placeholders. Replace them with the values for your own environment before running any command.

Item	Example Used in this Guide
Node hostnames	`nifi-node1.example.com`, `nifi-node2.example.com`, `nifi-node3.example.com`
Node IPs	`10.0.0.11`, `10.0.0.12`, `10.0.0.13`
NiFi mirror	[Index of /ODP/standalone/3.3.6.4-1/](Index of /ODP/standalone/3.3.6.4-1/)
SSH user	`nifiuser`
SSH key path	`~/.ssh/nifi-cluster-key`
Admin credentials	`admin` / `ChangeMe@123`

Cluster Topology

Host name	IP
`nifi-node1.example.com`	`10.0.0.11`
`nifi-node2.example.com`	`10.0.0.12`
`nifi-node3.example.com`	`10.0.0.13`

NiFi version: 2.7.2.3.3.6.4-1

Mirror: Index of /ODP/standalone/3.3.6.4-1/

Prerequisites (run on ALL 3 nodes)

1. Populate `/etc/hosts`

cat >> /etc/hosts <<EOF 10.0.0.11 nifi-node1.example.com 10.0.0.12 nifi-node2.example.com 10.0.0.13 nifi-node3.example.com EOF

2. Install JDK 21

sudo yum install -y java-21-openjdk-devel ls -d /usr/lib/jvm/java-21* /usr/lib/jvm/java-21-openjdk/bin/java -version

3. Set `JAVA_HOME`

echo 'export JAVA_HOME=/usr/lib/jvm/java-21-openjdk' >> ~/.bashrc source ~/.bashrc

Warning

NiFi 2.x requires Java 21. Java 8 and 11 will not work.

Step 1 — Download and extract tarballs (ALL 3 nodes)

mkdir -p /root/nifi-setup && cd /root/nifi-setup MIRROR=http://mirror.odp.acceldata.dev/ODP/standalone/3.3.6.4-1 # Download the outer bundle (contains NiFi, NiFi Toolkit, and NiFi Registry) wget ${MIRROR}/nifi-2.7.2.3.3.6.4-1.tar.gz # Extract the outer bundle — this yields three inner tarballs tar -xf nifi-2.7.2.3.3.6.4-1.tar.gz # Extract each component tar -xf nifi-2.7.2.3.3.6.4-1-bin.tar.gz tar -xf nifi-toolkit-2.7.2.3.3.6.4-1-bin.tar.gz tar -xf nifi-registry-2.7.2.3.3.6.4-1-bin.tar.gz

Set NIFI_HOME for convenience (ALL 3 nodes):

export NIFI_HOME=/root/nifi-setup/nifi-2.7.2.3.3.6.4-1

Step 2 — Set `JAVA_HOME` in `bootstrap.conf` (ALL 3 nodes)

Edit ${NIFI_HOME}/conf/bootstrap.conf and add the Java path as the first property:

# Java command to use when running NiFi java=/usr/lib/jvm/java-21-openjdk/bin/java

Step 3 — Configure NiFi for clustering (ALL 3 nodes)

Edit ${NIFI_HOME}/conf/nifi.properties on each node.

3a. Sensitive properties key (SAME on all 3 nodes

NiFi 2.x in cluster mode requires a shared sensitive properties key. Generate one once and use the same value on every node:

openssl rand -hex 16

nifi.sensitive.props.key=<your-generated-hex-key>

Critical

All cluster nodes must share the same nifi.sensitive.props.key. If they differ, nodes will fail to join.

3b. Web properties (different on each node)

# On NODE1: nifi.web.https.host=nifi-node1.example.com nifi.web.https.port=8443 # On NODE2: nifi.web.https.host=nifi-node2.example.com nifi.web.https.port=8443 # On NODE3: nifi.web.https.host=nifi-node3.example.com nifi.web.https.port=8443

3c. Cluster properties

SAME on all 3 nodes:

nifi.cluster.is.node=true nifi.cluster.node.protocol.port=11443 nifi.cluster.flow.election.max.wait.time=1 min nifi.cluster.flow.election.max.candidates=3

Per-node — set to each node's own FQDN:

# On NODE1: nifi.cluster.node.address=nifi-node1.example.com # On NODE2: nifi.cluster.node.address=nifi-node2.example.com # On NODE3: nifi.cluster.node.address=nifi-node3.example.com

3d. Embedded ZooKeeper (SAME on all 3 nodes)

nifi.state.management.embedded.zookeeper.start=true nifi.zookeeper.connect.string=nifi-node1.example.com:2181,nifi-node2.example.com:2181,nifi-node3.example.com:2181

Step 4 — Configure embedded ZooKeeper (ALL 3 nodes)

4a. Edit `${NIFI_HOME}/conf/zookeeper.properties`

Add the server list (SAME on all nodes):

server.1=nifi-node1.example.com:2888:3888;2181 server.2=nifi-node2.example.com:2888:3888;2181 server.3=nifi-node3.example.com:2888:3888;2181

4b. Create the ZooKeeper `myid` file

# On NODE1: mkdir -p ${NIFI_HOME}/state/zookeeper echo 1 > ${NIFI_HOME}/state/zookeeper/myid # On NODE2: mkdir -p ${NIFI_HOME}/state/zookeeper echo 2 > ${NIFI_HOME}/state/zookeeper/myid # On NODE3: mkdir -p ${NIFI_HOME}/state/zookeeper echo 3 > ${NIFI_HOME}/state/zookeeper/myid

Critical

The myid number must match the server.N entry for that node.

Step 5 — Configure State Management (ALL 3 nodes)

Edit ${NIFI_HOME}/conf/state-management.xml. Find the zk-provider cluster-provider section and set the connect string:

<cluster-provider> <id>zk-provider</id> <class>org.apache.nifi.controller.state.providers.zookeeper.ZooKeeperStateProvider</class> <property name="Connect String">nifi-node1.example.com:2181,nifi-node2.example.com:2181,nifi-node3.example.com:2181</property> <property name="Root Node">/nifi</property> <property name="Session Timeout">10 seconds</property> <property name="Access Control">CreatorOnly</property> </cluster-provider>

Step 6 — Cross-import TLS Certificates for Cluster Communication

NiFi 2.x auto-generates a self-signed certificate per node on first start. Since each node has its own CA, the nodes don't trust each other by default. You must export each node's certificate and import it into every node's truststore.

Start NiFi once on each node so it generates keystore.p12 and truststore.p12:

cd ${NIFI_HOME} ./bin/nifi.sh start # Wait ~30 seconds for certs to generate, then stop ./bin/nifi.sh stop

Verify the certs were created:

ls -la ${NIFI_HOME}/conf/keystore.p12 ${NIFI_HOME}/conf/truststore.p12

6b. Export each node's certificate (run on each respective node)

# On NODE1: keytool -exportcert -keystore ${NIFI_HOME}/conf/keystore.p12 \ -storepass $(grep nifi.security.keystorePasswd ${NIFI_HOME}/conf/nifi.properties | cut -d= -f2) \ -alias generated -file /tmp/node1.der # On NODE2: keytool -exportcert -keystore ${NIFI_HOME}/conf/keystore.p12 \ -storepass $(grep nifi.security.keystorePasswd ${NIFI_HOME}/conf/nifi.properties | cut -d= -f2) \ -alias generated -file /tmp/node2.der # On NODE3: keytool -exportcert -keystore ${NIFI_HOME}/conf/keystore.p12 \ -storepass $(grep nifi.security.keystorePasswd ${NIFI_HOME}/conf/nifi.properties | cut -d= -f2) \ -alias generated -file /tmp/node3.der

6c. Distribute certificates across all nodes

Run from NODE1 (assumes the SSH key at ~/.ssh/nifi-cluster-key is authorized for nifiuser on the other nodes):

chmod 600 ~/.ssh/nifi-cluster-key # Send NODE1's cert to the other two nodes scp -i ~/.ssh/nifi-cluster-key /tmp/node1.der nifiuser@nifi-node2.example.com:/tmp/ scp -i ~/.ssh/nifi-cluster-key /tmp/node1.der nifiuser@nifi-node3.example.com:/tmp/ # Pull the other two certs to NODE1 scp -i ~/.ssh/nifi-cluster-key nifiuser@nifi-node2.example.com:/tmp/node2.der /tmp/ scp -i ~/.ssh/nifi-cluster-key nifiuser@nifi-node3.example.com:/tmp/node3.der /tmp/ # Send NODE3's cert to NODE2 scp -i ~/.ssh/nifi-cluster-key /tmp/node3.der nifiuser@nifi-node2.example.com:/tmp/ # Send NODE2's cert to NODE3 scp -i ~/.ssh/nifi-cluster-key /tmp/node2.der nifiuser@nifi-node3.example.com:/tmp/

Verify all 3 .der files exist on each node:

ls -la /tmp/node1.der /tmp/node2.der /tmp/node3.der

6d. Import all Certificates into Each Node's Truststore (ALL 3 nodes)

TS_PASS=$(grep nifi.security.truststorePasswd ${NIFI_HOME}/conf/nifi.properties | cut -d= -f2) keytool -importcert -keystore ${NIFI_HOME}/conf/truststore.p12 \ -storepass ${TS_PASS} -alias node1 -file /tmp/node1.der -noprompt keytool -importcert -keystore ${NIFI_HOME}/conf/truststore.p12 \ -storepass ${TS_PASS} -alias node2 -file /tmp/node2.der -noprompt keytool -importcert -keystore ${NIFI_HOME}/conf/truststore.p12 \ -storepass ${TS_PASS} -alias node3 -file /tmp/node3.der -noprompt

Info

Importing a node's own cert may warn about a duplicate — that's fine.

6e. Verify Truststores

TS_PASS=$(grep nifi.security.truststorePasswd ${NIFI_HOME}/conf/nifi.properties | cut -d= -f2) keytool -list -keystore ${NIFI_HOME}/conf/truststore.p12 -storepass ${TS_PASS}

You should see entries for node1, node2, and node3 (plus the original generated entry).

Step 7 — Set login credentials (ALL 3 nodes)

cd ${NIFI_HOME} ./bin/nifi.sh set-single-user-credentials admin ChangeMe@123

Tip

Use the same username/password on all nodes. In single-user mode with a cluster, credentials must match.

Step 8 — Start the NiFi cluster (ALL 3 nodes)

Start all three nodes around the same time so cluster election can proceed:

cd ${NIFI_HOME} ./bin/nifi.sh start

Step 9 — Verify the cluster

Check NiFi status on each node:

./bin/nifi.sh status

Check port 8443 is listening:

ss -tlnp | grep 8443

Check logs for cluster join:

tail -200f ${NIFI_HOME}/logs/nifi-app.log | grep -iE "cluster|connected|coordinator|elected"

Look for messages like Node connected and Cluster coordinator elected

Access the Web UI:

https://nifi-node1.example.com:8443/nifi https://nifi-node2.example.com:8443/nifi https://nifi-node3.example.com:8443/nifi

Login with admin / ChangeMe@123. Once in, open the hamburger menu (top-left) → Cluster to confirm all 3 nodes appear with status CONNECTED.

Summary — what differs per node

Setting	Node 1	Node 2	Node 3
`nifi.web.https.host`	`nifi-node1.example.com`	`nifi-node2.example.com`	`nifi-node3.example.com`
`nifi.cluster.node.address`	`nifi-node1.example.com`	`nifi-node2.example.com`	`nifi-node3.example.com`
`state/zookeeper/myid`	`1`	`2`	`3`
`keystore.p12` / `truststore.p12` passwords	auto-generated per node	auto-generated per node	auto-generated per node

Everything else (sensitive props key, ZK connect string, cluster settings, login credentials) is identical across all three nodes.

Troubleshooting

nifi.sensitive.props.key error. NiFi 2.x requires this in cluster mode. Generate with openssl rand -hex 16 and use the same value on all nodes.
certificate_unknown / PKIX path validation errors. Each node auto-generates its own self-signed cert. Cross-import all certs into each node's truststore (Step 6).
TLS toolkit missing. NiFi 2.x removed the TLS toolkit. Use the manual cert export/import approach above.
ZooKeeper issues. Check logs/nifi-app.log for ZK errors. Verify myid files match the server.N entries.
Flow election timeout. If nodes start at very different times, increase nifi.cluster.flow.election.max.wait.time (e.g. 5 mins).
"Already running" after a crash. Remove the PID file: rm -f ${NIFI_HOME}/run/nifi.pid, then start again.
Browser TLS warning. NiFi 2.x uses self-signed certs by default — accept the browser warning to proceed, or replace the auto-generated keystore with a CA-signed cert.

Last updated on May 15, 2026

Was this page helpful?