CDP Deployment for Single KDC

This document provides a step by step process to deploy single Pulse instance for Cloudera clusters with single KDC.

Prerequisites

Keep the following information handy:

CM URL (https://<Alias/FQDN of the CM URL>:<CM Port>)
CM Username
CM Password
Spark History HDFS path & Spark3 History HDFS path
Kafka Version
Hbase Version
Hive Version
Hive Metastore DB Connection URL
hive metastore Database Name
hive metastore DB Username
hive metastore DB Password
Oozie DB Name
Oozie DB URL
Oozie DB Username
Oozie DB Password
Kerberos Keytab
krb5.conf file
Principal
Kerberos Username
cacerts/jssecacerts
YARN Scheduler Type
Kafka Interbroker protocol

Certificate File: cert.crt
Certificate Key: cert.key
CA Certificate: ca.crt (optional)
Decide whether to keep the HTTP port (Default: 4000) open or not
Decide on which port to use (default: 443)

Download the Binaries and Docker Images and Load Them

Download the jars, hystaller, accelo binaries, and docker images from the download links provided by Acceldata.
Move the docker images and jars in the following directory:

Bash
    
xxxxxxxxxx
 
mkdir -p /data01/images
Copy

Copy the binaries and tar files in to the /data01/images folder.

Bash
    
xxxxxxxxxx
 
cp </path/to/binaries/tar> /data01/images
Copy

Change the directory.

Bash
    
xxxxxxxxxx
 
cd /data01/images
Copy

Extract the single tar file.

Bash
    
xxxxxxxxxx
 
tar xvf <name_of_tar_file>.tar
Copy

OUTPUT

Bash
    
Copy

Load the Docker images by running the following command:

Bash
    
Copy

Check if all the images are loaded into the server.

Bash
    
Copy

Config Cluster

Validate the all the hosts file.
Create the acceldata dir by running the following command:

Bash
    
Copy

Copy the Spark hosts and Zookeeper hosts file in acceldata directory, by running the following command:

Bash
    
Copy

Place the accelo binary in the /data01/acceldata directory.

Bash
    
Copy

Rename the accelo.linux binary to accelo.

Bash
    
Copy

Change the directory.

Bash
    
Copy

Run the following command to do accelo init :

Bash
    
Copy

Enter the appropriate answers when prompted.
Source the ad.sh file.

Bash
    
Copy

Run the init command to provide the Pulse version.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Provide the correct Pulse version, in this case it will be 3.3.3.

Now run accelo info command to get the initial info.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Run the config cluster command to configure the cluster in Pulse.

Bash
    
Copy

Provide appropriate answers when prompted.

Bash
    
Copy

Copy the License

Place the license file provided by Acceldata in the work directory.

Bash
    
Copy

Deploy Core

Deploy the Pulse core components by running the following command:

Bash
    
Copy

OUTPUT

Bash
    
Copy

Configure SSL For Connectors and Streaming

If you have TLS/SSL enforced for any of the Hadoop components in the target cluster, you have to bind-mount the Java truststore files inside the containers for the following Pulse services.

ad-connectors
ad-sparkstats
ad-streaming
ad-kafka-connector
ad-kafka-0-10-2-connector
ad-fsanalyticsv2-connector

For Kafka connectors, first, verify the version of Kafka running in your cluster, and then generate the configurations accordingly.

Only these services will establish connections to the corresponding Hadoop components of the cluster via the HTTPS URI.

Ensure that the permissions of these files are set to 0655 . i.e, read-able for all the users.

Bash
    
Copy

It's not obligatory to have both configuration files available for a target cluster. Sometimes, you might only have one of the files accessible. In such cases, you can simply utilize the available file and disregard the other.

AD-CONNECTORS & AD-SPARKSTATS

Generate the ad-core-connectors configuration file if not present:

Bash
    
Copy

Edit the file in path <$AcceloHome>/config/docker/addons/ad-core-connectors.yml and add the following lines under the volumes section of both ad-connectors and ad-sparkstats service blocks.

Bash
    
Copy

If you only have the jssecacert file available and not the cacerts file, you can mount the jssecacerts file as the cacerts file inside the container, as demonstrated below:

Bash
    
Copy

AD-STREAMING

Generate the ad-core configuration file if not present:

Bash
    
Copy

Edit the file in path <$AcceloHome>/config/docker/ad-core.yml and add the following lines under the volumes section of ad-streaming service block.

Bash
    
Copy

If you only have the jssecacert file available and not the cacerts file, you can mount the jssecacerts file as the cacerts file inside the container, as demonstrated below:

Bash
    
Copy

AD-FSANALYTICSV2-CONNECTOR

Generate the ad-fsanalyticsv2-connector configuration file if not present:

Bash
    
Copy

Edit the file in path <$AcceloHome>/config/docker/addons/ad-fsanalyticsv2-connector.yml and add the following lines under the volumes section of ad-fsanalyticsv2-connector.

Bash
    
Copy

If you only have the jssecacert file available and not the cacerts file, you can mount the jssecacerts file as the cacerts file inside the container, as demonstrated below:

Bash
    
Copy

AD-KAFKA-CONNECTOR

Generate the ad-core-connectors configuration file if not present:

Bash
    
Copy

Edit the file in path <$AcceloHome>/config/docker/addons/ad-kafka-connector.yml and add the following lines under the volumes section of ad-kafka-connector.

Bash
    
Copy

If you only have the jssecacert file available and not the cacerts file, you can mount the jssecacerts file as the cacerts file inside the container, as demonstrated below:

Bash
    
Copy

AD-KAFKA-0-10-2-CONNECTOR

Generate the ad-core-connectors configuration file if not present:

Bash
    
Copy

Edit the file in path <$AcceloHome>/config/docker/addons/ad-kafka-0-10-2-connector.yml and add the following lines under the volumes section of ad-kafka-0-10-2-connector.

Bash
    
Copy

If you only have the jssecacert file available and not the cacerts file, you can mount the jssecacerts file as the cacerts file inside the container, as demonstrated below:

Bash
    
Copy

Deploy Addons

Run the following command to deploy the Pulse addons, and then select the components that are needed for Spark standalone:

Bash
    
Copy

OUTPUT

Bash
    
Copy

Configure Alerts Notifications

For setting the active cluster, run the following command:

Bash
    
Copy

Configure the alerts notifications.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Set the cluster2 as the active cluster.

Bash
    
Copy

Configure the alerts for the second cluster.

Bash
    
Copy

Set the cluster3 as the active cluster.

Bash
    
Copy

Configure the alerts for the third cluster.

Bash
    
Copy

Restart the alerts notifications.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Database Push Configuration

Run the following command to push config to db:

Bash
    
Copy

Configure Gauntlet

Updating the Gauntlet Crontab Duration

Check if the ad-core.yml file is present or not by running the following command:

Bash
    
Copy

If the above file is not present, then generate it by running the following command:

Bash
    
Copy

Edit the ad-core.yml file.

a. Open the file.

Bash
    
Copy

b. Update the CRON_TAB_DURATION env variable in the ad-gauntlet section.

Bash
    
Copy

This makes gauntlet run every two days at midnight.

c. The updated file will look something like this:

Bash
    
Copy

d. Save the file.

Restart gauntlet service by running the following command:

Bash
    
Copy

Updating the Gauntlet Dry Run Mode

Check if the ad-core.yml file is present or not by running the following command:

Bash
    
Copy

If the above file is not present, then generate it by running the following command:

Bash
    
Copy

Edit the ad-core.yml file.

a. Open the file.

Bash
    
Copy

b. Update the DRY_RUN_ENABLE env variable in the ad-gauntlet section.

Bash
    
Copy

This will make the gauntlet delete the older elastic indices and MongoDB data.

c. The updated file will look something like this:

Bash
    
Copy

d. Save the file.

Restart gauntlet service by running the following command:

Bash
    
Copy

Configuring Gauntlet for Multi Node and Multi Cluster Deployment

Run the following command to generate the gauntlet config files:

Bash
    
Copy

Change the dir to config/gauntlet/ .

Bash
    
Copy

Check if all the files are present or not for all the clusters or not.

Bash
    
Copy

Modify the gauntlet_elastic_<clustername>.yml file.

Bash
    
Copy

Edit the elastic address in the file for multi node setup.

Bash
    
Copy

Modify the elastic address for both clusters.
Push the config to database.

Bash
    
Copy

Restart the gauntlet service.

Bash
    
Copy

Updating MongoDB Cleanup and Compaction Frequency in Hours

By default, when dry run is disabled MongoDB cleanup and compaction will run once a day. To configure the frequency, follow the steps listed below:

Run the following command:

Bash
    
Copy

Answer the prompts. If you’re unsure about how many days you wish to retain, then proceed with the default values.

Bash
    
Copy

When the following prompt comes up, specify the hours of the day during which you would like MongoDB clean up and compaction to run. The value must be a CSV of hours as per the 24 hour time notation.

Bash
    
Copy

Run the following command. When gauntlet runs the next time, MongoDB clean up and compaction will run at the specified hours, once per hour.

Bash
    
Copy

Enabling (TLS) HTTPS for Pulse Web UI Configuration Using ad-proxy

Deployment and Configuration

Copy the cert.crt, cert.key and ca.crt (optional) files to $AcceloHome/config/proxy/certs location.
Check if ad-core.yml file is present or not.

Bash
    
Copy

If ad-core.yml file is not present, then generate the ad-core.yml file.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Modify the ad-core.yml file.

a. Open the ad-core.yml file.

Bash
    
Copy

b. Remove the ports: field in the ad-graphql section of ad-core.yml .

Bash
    
Copy

c. The resulting ad-graphql section will look like this:

Bash
    
Copy

d. Save the file.

Restart the ad-graphql container.

Bash
    
Copy

Check if the port is not exposed to host.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Check if there any errors in ad-graphql container.

Bash
    
Copy

Deploy the ad-proxy addons, run the following command and select Proxy from the list and press enter.

Bash
    
Copy

Now you can access the Pulse UI using https://<pulse-server-hostname> By default the port used is 443.

Configuration

If you want to change the SSL port to another port, follow the steps below:

Check if ad-proxy.yml file is present or not.

Bash
    
Copy

Generate the ad-proxy.yml file if its not present.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Modify the ad-core.yml file.

a. Open the ad-proxy.yml file.

Bash
    
Copy

b. Change the host port in the ports list to the desired port.

Bash
    
Copy

The final file will look like this if the host port is 6003 :

Bash
    
Copy

c. Save the file.

Restart the ad-proxy container.

Bash
    
Copy

Check if there are any errors.

Bash
    
Copy

Now you can access the Pulse UI using https://<pulse-server-hostname>:6003 .

Set Up LDAP for Pulse UI

Check if the ldap.conf is present or not.

Bash
    
Copy

Run the configure command to generate the default ldap.conf if not already present.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Edit the file in path $AcceloHome/config/ldap/ldap.conf .

Bash
    
Copy

Configure file for below properties:
- LDAP FQDN : FQDN where LDAP server is running
  - host = [FQDN]
- If port 389 is being used then
  - insecureNoSSL = true
- SSL root CA Certificate
  - rootCA = [CERTIFICATE_FILE_PATH]
- bindDN : to be used for ldap search need to be member of admin group
- bindPW : password for entering in database, can be removed later once ldapgets enabled
- baseDN used for user search
  - Eg: (cn=users, cn=accounts, dc=accedata, dc=io)
- Filter used for the user search
  - Eg: (objectClass=person)
- baseDN used for group search
  - Eg: (cn= groups, cn=accounts, dc=acceldata, dc=io)
- Group Search: Object class used for group search
  - Eg: (objectClass= posixgroup)

Here is the command to check if user has search entry access and group access in LDAP directory:

Bash
    
Copy

If the file is already generated it will ask for the LDAP credentials to validate the connectivity and configurations which are mentioned in the below steps.

Run the configure command.

Bash
    
Copy

It will ask for the LDAP user credentials.

Bash
    
Copy

If things went correctly, it will show the below confirmation message:

Bash
    
Copy

Press ‘y' and press 'Enter’.

OUTPUT

Bash
    
Copy

Push the LDAP config.

Bash
    
Copy

Run the deploy add-ons command.

Bash
    
Copy

Select the LDAP from the list shown and click Enter.

Bash
    
Copy

OUTPUT

Bash
    
Copy

Run the restart command.

Bash
    
Copy

Open Pulse Web UI and create default roles.
Create an ops role with the necessary access permissions. Any users who log in via LDAP will automatically be assigned to this role.

Last updated on

Was this page helpful?