Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BIGTOP-3846 Add Apache Knox MPack #1036

Closed
wants to merge 2 commits into from
Closed

BIGTOP-3846 Add Apache Knox MPack #1036

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7f685b8
Add KNOX mpack
cheelio Oct 12, 2022
097458e
Merge branch 'apache:master' into feature/add-knox-mpack-only
cheelio Oct 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions ...bari-mpack/bgtp-ambari-mpack/src/main/resources/stacks/BGTP/1.0/services/KNOX/alerts.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
{
"KNOX": {
"service": [],
"KNOX_GATEWAY": [
{
"name": "knox_gateway_process",
"label": "Knox Gateway Process",
"description": "This host-level alert is triggered if the Knox Gateway cannot be determined to be up.",
"interval": 1,
"scope": "HOST",
"source": {
"type": "PORT",
"uri": "{{gateway-site/gateway.port}}",
"default_port": 8443,
"reporting": {
"ok": {
"text": "TCP OK - {0:.3f}s response on port {1}"
},
"warning": {
"text": "TCP OK - {0:.3f}s response on port {1}",
"value": 1.5
},
"critical": {
"text": "Connection failed: {0} to {1}:{2}",
"value": 5.0
}
}
}
}
]
}
}
105 changes: 105 additions & 0 deletions ...i-mpack/src/main/resources/stacks/BGTP/1.0/services/KNOX/configuration/admin-topology.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,105 @@
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
<!--
/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-->
<configuration supports_final="false" supports_adding_forbidden="true">
<!-- topology file -->
<property>
<name>content</name>
<display-name>admin-topology template</display-name>
<value>
&lt;topology&gt;

&lt;gateway&gt;

&lt;provider&gt;
&lt;role&gt;authentication&lt;/role&gt;
&lt;name&gt;ShiroProvider&lt;/name&gt;
&lt;enabled&gt;true&lt;/enabled&gt;
&lt;param&gt;
&lt;name&gt;sessionTimeout&lt;/name&gt;
&lt;value&gt;30&lt;/value&gt;
&lt;/param&gt;
&lt;param&gt;
&lt;name&gt;main.ldapRealm&lt;/name&gt;
&lt;value&gt;org.apache.hadoop.gateway.shirorealm.KnoxLdapRealm&lt;/value&gt;
&lt;/param&gt;
&lt;param&gt;
&lt;name&gt;main.ldapRealm.userDnTemplate&lt;/name&gt;
&lt;value&gt;uid={0},ou=people,dc=hadoop,dc=apache,dc=org&lt;/value&gt;
&lt;/param&gt;
&lt;param&gt;
&lt;name&gt;main.ldapRealm.contextFactory.url&lt;/name&gt;
&lt;value&gt;ldap://{{knox_host_name}}:33389&lt;/value&gt;
&lt;/param&gt;
&lt;param&gt;
&lt;name&gt;main.ldapRealm.contextFactory.authenticationMechanism&lt;/name&gt;
&lt;value&gt;simple&lt;/value&gt;
&lt;/param&gt;
&lt;param&gt;
&lt;name&gt;urls./**&lt;/name&gt;
&lt;value&gt;authcBasic&lt;/value&gt;
&lt;/param&gt;
&lt;/provider&gt;

&lt;provider&gt;
&lt;role&gt;authorization&lt;/role&gt;
&lt;name&gt;AclsAuthz&lt;/name&gt;
&lt;enabled&gt;true&lt;/enabled&gt;
&lt;param&gt;
&lt;name>knox.acl.mode&lt;/name&gt;
&lt;value&gt;OR&lt;/value&gt;
&lt;/param&gt;
&lt;param&gt;
&lt;name&gt;knox.acl&lt;/name&gt;
&lt;value&gt;KNOX_ADMIN_USERS;KNOX_ADMIN_GROUPS;*&lt;/value&gt;
&lt;/param&gt;
&lt;/provider&gt;

&lt;provider&gt;
&lt;role&gt;identity-assertion&lt;/role&gt;
&lt;name&gt;HadoopGroupProvider&lt;/name&gt;
&lt;enabled&gt;true&lt;/enabled&gt;
&lt;param&gt;
&lt;name&gt;CENTRAL_GROUP_CONFIG_PREFIX&lt;/name&gt;
&lt;value&gt;gateway.group.config.&lt;/value&gt;
&lt;/param&gt;
&lt;/provider&gt;

&lt;/gateway&gt;

&lt;service&gt;
&lt;role&gt;KNOX&lt;/role&gt;
&lt;/service&gt;

&lt;/topology&gt;

</value>
<description>
The configuration specifies the Knox admin API configuration and access details. The authentication provider should be configured to match your deployment details.
</description>
<value-attributes>
<type>content</type>
<empty-value-valid>true</empty-value-valid>
<show-property-name>false</show-property-name>
</value-attributes>
<on-ambari-upgrade add="false"/>
</property>
</configuration>
110 changes: 110 additions & 0 deletions ...ri-mpack/src/main/resources/stacks/BGTP/1.0/services/KNOX/configuration/gateway-log4j.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,110 @@
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
<!--
/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-->
<configuration supports_final="false" supports_adding_forbidden="false">
<property>
<name>knox_gateway_log_maxfilesize</name>
<value>256</value>
<description>The maximum size of backup file before the log is rotated</description>
<display-name>Knox Gateway Log: backup file size</display-name>
<value-attributes>
<unit>MB</unit>
</value-attributes>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>knox_gateway_log_maxbackupindex</name>
<value>20</value>
<description>The number of backup files</description>
<display-name>Knox Gateway Log: # of backup files</display-name>
<value-attributes>
<type>int</type>
<minimum>0</minimum>
</value-attributes>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>content</name>
<display-name>gateway-log4j template</display-name>
<value>

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

app.log.dir=${launcher.dir}/../logs
app.log.file=${launcher.name}.log
app.audit.file=${launcher.name}-audit.log

log4j.rootLogger=ERROR, drfa

log4j.logger.org.apache.knox.gateway=INFO
#log4j.logger.org.apache.knox.gateway=DEBUG

#log4j.logger.org.eclipse.jetty=DEBUG
#log4j.logger.org.apache.shiro=DEBUG
#log4j.logger.org.apache.http=DEBUG
#log4j.logger.org.apache.http.client=DEBUG
#log4j.logger.org.apache.http.headers=DEBUG
#log4j.logger.org.apache.http.wire=DEBUG

log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d{yy/MM/dd HH:mm:ss} %p %c{2}: %m%n

log4j.appender.drfa=org.apache.log4j.DailyRollingFileAppender
log4j.appender.drfa.File=${app.log.dir}/${app.log.file}
log4j.appender.drfa.DatePattern=.yyyy-MM-dd
log4j.appender.drfa.layout=org.apache.log4j.PatternLayout
log4j.appender.drfa.layout.ConversionPattern=%d{ISO8601} %-5p %c{2} (%F:%M(%L)) - %m%n
log4j.appender.drfa.MaxFileSize = {{knox_gateway_log_maxfilesize}}MB
log4j.appender.drfa.MaxBackupIndex = {{knox_gateway_log_maxbackupindex}}

log4j.logger.audit=INFO, auditfile
log4j.appender.auditfile=org.apache.log4j.DailyRollingFileAppender
log4j.appender.auditfile.File=${app.log.dir}/${app.audit.file}
log4j.appender.auditfile.Append = true
log4j.appender.auditfile.DatePattern = '.'yyyy-MM-dd
log4j.appender.auditfile.layout = org.apache.hadoop.gateway.audit.log4j.layout.AuditLayout

</value>
<description>
content for log4j.properties file for Knox.
</description>
<value-attributes>
<type>content</type>
<show-property-name>false</show-property-name>
</value-attributes>
<on-ambari-upgrade add="false"/>
</property>
</configuration>
99 changes: 99 additions & 0 deletions ...ari-mpack/src/main/resources/stacks/BGTP/1.0/services/KNOX/configuration/gateway-site.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- The default settings for Knox. -->
<!-- Edit gateway-site.xml to change settings for your local -->
<!-- install. -->
<configuration supports_final="false">
<property>
<name>gateway.port</name>
<value>8443</value>
<description>The HTTP port for the Gateway.</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>gateway.path</name>
<value>gateway</value>
<description>The default context path for the gateway.</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>gateway.gateway.conf.dir</name>
<display-name>Gateway Conf directory</display-name>
<value>deployments</value>
<description>The directory within GATEWAY_HOME that contains gateway topology files and deployments.</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>gateway.hadoop.kerberos.secured</name>
<value>false</value>
<description>Boolean flag indicating whether the Hadoop cluster protected by Gateway is secured with Kerberos</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>java.security.krb5.conf</name>
<value>/etc/knox/conf/krb5.conf</value>
<description>Absolute path to krb5.conf file</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>java.security.auth.login.config</name>
<value>/etc/knox/conf/krb5JAASLogin.conf</value>
<description>Absolute path to JASS login config file</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>sun.security.krb5.debug</name>
<value>false</value>
<description>Boolean flag indicating whether to enable debug messages for krb5 authentication</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>gateway.websocket.feature.enabled</name>
<value>{{websocket_support}}</value>
<description>Enable this if you want websocket support</description>
<on-ambari-upgrade add="false"/>
</property>
<property>
<name>gateway.knox.admin.users</name>
<value>admin</value>
<description>Comma separated list of usernames to grant access to Knox Admin UI and API</description>
<on-ambari-upgrade add="true"/>
</property>
<property>
<name>gateway.knox.admin.groups</name>
<value>admin</value>
<description>Comma separated list of groups to grant access to Knox Admin UI and API</description>
<on-ambari-upgrade add="true"/>
</property>
<property>
<name>gateway.dispatch.whitelist.services</name>
<value>DATANODE,HBASEUI,HDFSUI,JOBHISTORYUI,NODEUI,YARNUI,knoxauth</value>
<description>The comma-delimited list of service roles for which the gateway.dispatch.whitelist should be applied.</description>
</property>
<property>
<name>gateway.dispatch.whitelist</name>
<value>DEFAULT</value>
<description>The whitelist to be applied for dispatches associated with the service roles specified by gateway.dispatch.whitelist.services. If the value is DEFAULT, a domain-based whitelist will be derived from the Knox host.</description>
</property>
<property>
<name>gateway.read.only.override.topologies</name>
<value>admin,knoxsso,default</value>
<description>Since Ambari manages these topologies let's make them read-only in the Knox Admin UI so that they don't get overwritten by Ambari on restart.</description>
</property>
</configuration>
Loading