Security Configuration

Kerberos / SPNEGO Authentication

When the cluster has Kerberos enabled, Celeborn automatically configures NEGOTIATE for HTTP endpoints. Ambari auto-configures the following properties:

celeborn.master.http.auth.supportedSchemes=NEGOTIATE celeborn.master.http.spnego.keytab=/etc/security/keytabs/spnego.service.keytab celeborn.master.http.spnego.principal=HTTP/_HOST@REALM

TLS / SSL Encryption

# Enable SSL for RPC traffic celeborn.ssl.rpc_service.enabled=true celeborn.ssl.rpc_service.keyStore=/path/to/keystore.jks celeborn.ssl.rpc_service.keyStorePassword=<password> celeborn.ssl.rpc_service.trustStore=/path/to/truststore.jks celeborn.ssl.rpc_service.trustStorePassword=<password> # Enable SSL for data transfer channels celeborn.ssl.push.enabled=true celeborn.ssl.fetch.enabled=true celeborn.ssl.replicate.enabled=true

Internal Port Authentication

celeborn.auth.enabled=true celeborn.internal.port.enabled=true celeborn.master.internal.endpoints=master1:19097,master2:19097,master3:19097

Last updated on Apr 23, 2026

Was this page helpful?