Configure LDAP and SSL for Impala on Kubernetes using CLI

Sergei Tikhomirov

Prerequisites

  • An ADH cluster (4.2.0 or later) is installed.

  • Impala is deployed in Kubernetes according to the instruction.

  • SSL is enabled for the ADH cluster. This step is optional but recommended for security purposes. This guide presumes that this step was completed.

To access Impala web UI and allow JDBC connections, generate certificates for Ingress and load balancer:

$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout impala-cloud.ru-central1.internal.key -out impala-cloud.ru-central1.internal.crt -subj "/CN=impala-cloud.ru-central1.internal"
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout impala-jdbc.ru-central1.internal.key -out impala-jdbc.ru-central1.internal.crt -subj "/CN=impala-jdbc.ru-central1.internal"
NOTE
The Kerberos and LDAP authentications are mutually exclusive.

Step 1. Update the Impala cluster configuration

  1. Prepare an updated version of the hadoop_conf.yaml file with enabled SSL:

    hadoop_conf.yaml

    • HDFS

    • S3

    sites:
  core:
    fs.defaultFS: hdfs://adh
    hadoop.security.authentication: simple
    dfs.client.failover.proxy.provider.adh: org.apache.hadoop.hdfs.server.namenode.ha.ObserverReadProxyProvider
    dfs.ha.namenodes.adh: nn_tsn-adh-k8s-1,nn_tsn-adh-k8s-3
    dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:8020
    dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:8020
    dfs.nameservices: adh
    hadoop.ssl.enabled: true
  hdfs:
    dfs.client.read.shortcircuit: false
  ozone:
    ozone.om.address.adh.om_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:9862
    ozone.om.address.adh.om_tsn-adh-k8s-2: tsn-adh-k8s-2.ru-central1.internal:9862
    ozone.om.address.adh.om_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:9862
    ozone.om.nodes.adh: om_tsn-adh-k8s-1,om_tsn-adh-k8s-2,om_tsn-adh-k8s-3
    ozone.om.service.ids: adhom
  hive:
    hive.metastore.sasl.enabled: false
    hive.metastore.uris: thrift://tsn-adh-k8s-1.ru-central1.internal:9083
    metastore.use.SSL: true
    sites:
  core:
    fs.defaultFS: s3a://demo-s3
    fs.s3a.impl: org.apache.hadoop.fs.s3a.S3AFileSystem
    fs.s3a.access.key: p.petrov@RU-CENTRAL1.INTERNAL
    fs.s3a.secret.key: 3ab197f82fac43374519b4ad3015a76c778acf51897cf73f409ecba827e64255
  hive:
    hive.metastore.uris: thrift://hms-adh-nia-01.ru-central1.internal:9083
    metastore.use.SSL: true
    fs.s3a.endpoint: http://adh-ctrl-nia-02.ru-central1.internal:9879
    fs.s3a.path.style.access: true
    hive.metastore.warehouse.dir: s3a://demo-s3/apps/hive/warehouse

  2. Initialize the Impala cluster:

    $ ./adc init --impala-cluster --hadoop-file hadoop_conf.yaml -o impala-cluster.yaml

    This operation creates the impala-cluster.yaml file with a configuration template.

  3. Edit the impala-cluster.yaml configuration file by adding the LDAP, SSL, TLS, CA, and web TLS settings blocks:

    impala-cluster.yaml

    • HDFS

    • S3

    apiVersion: adc.arenadata.io/v1alpha1
kind: ImpalaCluster
metadata:
  name: impala
  namespace: impala (1)
spec:
  image: hub.arenadata.io/adc-enterprise/impala:<tag> (2)

  ## Image pull secret for a private registry.
  ## Set 'externalSecretName' to reference an existing Secret,
  ## or set 'credentials' and optionally 'secretName' to let the CLI create one.
  #imagePullSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-registry-secret
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-registry-secret
  #
  #  #credentials:
  #  #  registry: registry.example.com
  #  #  username: user
  #  #  password: pass

  hadoop: (3)
    core:
      dfs.client.failover.proxy.provider.adh: org.apache.hadoop.hdfs.server.namenode.ha.ObserverReadProxyProvider
      dfs.ha.namenodes.adh: nn_tsn-adh-k8s-1,nn_tsn-adh-k8s-3
      dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:8020
      dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:8020
      dfs.nameservices: adh
      fs.defaultFS: hdfs://adh
      hadoop.security.authentication: simple
      hadoop.ssl.enabled: "true"
    hdfs:
      dfs.client.read.shortcircuit: "false"
    hive:
      hive.metastore.sasl.enabled: "false"
      hive.metastore.uris: thrift://tsn-adh-k8s-1.ru-central1.internal:9083
      metastore.truststore.password: bigdata
      metastore.truststore.path: /etc/ssl/truststore.jks
      metastore.use.SSL: "true"
    ozone:
      ozone.om.address.adh.om_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:9862
      ozone.om.address.adh.om_tsn-adh-k8s-2: tsn-adh-k8s-2.ru-central1.internal:9862
      ozone.om.address.adh.om_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:9862
      ozone.om.nodes.adh: om_tsn-adh-k8s-1,om_tsn-adh-k8s-2,om_tsn-adh-k8s-3
      ozone.om.service.ids: adhom

  ## Kerberos configuration for authentication.
  #kerberos:
  #  realm: EXAMPLE.COM
  #
  #  # Service name in the Kerberos principal. Defaults to the product name.
  #  service: impala
  #
  #  # Hostname in the Kerberos principal.
  #  # Required for a fixed service principal; leave it empty only to derive one principal per pod from the cluster domain.
  #  hostname: kerberos.example.com
  #  keytab:
  #    # true - kerberos-operator creates the keytab Secret.
  #    # false (default) - reference an existing keytab Secret with name keytab.secretName.
  #    create: false
  #
  #    # Name of the keytab Secret.
  #    # Optional when create: true - names the generated Secret (default: <name>-keytab).
  #    # Required when create: false - must reference an existing Secret.
  #    secretName: kerberos-secret
  #
  #    # Label selector for the Pod that generates the keytab.
  #    # Required when create: true; ignored when create: false.
  #    labelSelector:
  #      env: prod
  #    #additionalPrincipals:
  #    #  - HTTP/kerberos.example.com
  #
  #    clusterDomain: cluster.local
  #    rotation:
  #      interval: 24h
  #      checkInterval: 1h

  ## LDAP authentication configuration.
  ## Uncomment and fill url and userBindPattern.
  ## For ldaps:// URLs the ssl: or ca: section must also be configured (depends on product)
  ldap:
  #  # LDAP service url.
    url: ldaps://ad01.adsw.io:636 (4)
  #
  #  # LDAP user Bind pattern.
    userBindPattern: cn=#UID,OU=kerberos,OU=adh,DC=ad,DC=ranger-test (5)

  ## Ranger plugin configuration.
  ## Uncomment and fill the lines below. adc apply derives the rest.
  #ranger:
  #  # fill ranger.plugin.impala.policy.rest.url below with Ranger endpoint, e.g. https://adps-adc.ru-central1.internal:6182
  #  # fill ranger.plugin.impala.service.name below with Ranger service name you want to use for product, e.g. adc_impala_id_1
  #  security:
  #    ranger.plugin.impala.policy.rest.url: ""
  #    ranger.plugin.impala.service.name: ""
  #
  #  # fill xasecure.audit.destination.solr.zookeepers below with Zookeepers endpoints to resolve solr service, e.g. adps-adc.ru-central1.internal:2181/Arenadata.Hadoop-2.solr.server
  #  audit:
  #    xasecure.audit.destination.solr.zookeepers: ""
  #
  #  # Local Ranger files 'adc apply' writes into the configs Secret.
  #  # Relative paths are resolved against the config file.
  #  files:
  #    jceksStorePath: /path/to/ranger.jceks

  ## Java KeyStore/TrustStore certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  ssl: (6)
  #  ## Name of the Secret containing Java keystores.
    secretName: ssl-secret
  #  externalSecretName: existing-ssl-secret
  #
  #  # Key in the Secret containing the truststore file.
    trustStoreKey: truststore.jks
  #
  #  ## Password for the truststore (optional).
    trustStorePassword: bigdata
  #
  #  ## Key in the Secret containing the keystore file (optional).
  #  #keyStoreKey: keystore.jks
  #
  #  ## Password for the keystore (optional).
  #  #keyStorePassword: bigdata
  #
  #  ## Local files 'adc apply' puts into the Secret named by ssl.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      trustStorePath: /etc/ssl/truststore.jks
  #  #  #keyStorePath: /path/to/keystore.jks

  ## Use an external complete configs Secret instead of the one rendered by ADC.
  #configsSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-impala-configs
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-impala-configs

  catalog:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  coordinator:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  executor:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  statestore:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata

  ## Monitoring configuration.
  #monitoring:
  #  # Enables Prometheus metrics export from this product's pods.
  #  exportMetrics: true

  ## Admission-control resource pools. Rendered into a coordinator-only Secret (fair-scheduler.xml and optional llama-site.xml) mounted at /opt/impala/resource-pools.
  #resourcePools:
  #  # Fair-scheduler queue tree and placement policy, rendered to fair-scheduler.xml.
  #  allocations:
  #    # Queue tree, rooted at a single queue.
  #    queues:
  #      - aclSubmitApps: ' '
  #        name: root
  #        queues:
  #        - aclSubmitApps: '*'
  #          maxResources:
  #            memory: 50000
  #            vcores: 0
  #          name: default
  #          type: leaf
  #        type: parent
  #
  #    # Rules that route an incoming query to a queue.
  #    queuePlacementPolicy:
  #      rules:
  #        - create: false
  #          name: specified
  #        - name: default
  #
  #  # Raw llama-site.xml properties, rendered verbatim in list order.
  #  llamaProperties:
  #    # List of name/value pairs written to llama-site.xml.
  #    properties:
  #      - name: llama.am.throttling.maximum.placed.reservations.root.default
  #        value: "10"

  ## TLS certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  tls: (7)
  #  ## Optional name of the Secret ADC creates from local files.
    secretName: tls-secret
  #  externalSecretName: existing-tls-secret
  #
  #  # Key in the Secret containing the TLS certificate.
    certificateKey: tls.crt
  #
  #  # Key in the Secret containing the TLS private key.
    privateKey: tls.key
  #
  #  ## Key in the Secret containing the client CA certificate.
  #  #clientCaCertificate: ca.crt
  #
  #  ## Local files 'adc apply' puts into the Secret named by tls.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: impala-jdbc.ru-central1.internal.crt
      privateKeyPath: impala-jdbc.ru-central1.internal.key
  #  #  #clientCaCertificatePath: /path/to/ca.crt

  ## TLS certificate configuration for web UI and HTTP endpoints.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  webTLS: (8)
  #  ## Optional name of the Secret ADC creates from local files.
    secretName: web-tls-secret
  #  externalSecretName: existing-web-tls-secret
  #
  #  # Key in the Secret containing the web TLS certificate.
    certificateKey: tls.crt
  #
  #  # Key in the Secret containing the web TLS private key.
    privateKey: tls.key
  #
  #  ## Local files 'adc apply' puts into the Secret named by webTLS.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: impala-cloud.ru-central1.internal.crt
      privateKeyPath: impala-cloud.ru-central1.internal.key

  ## CA certificate configuration for Impala.
  ## Set externalSecretName, or let ADC create a Secret from files.
  ca: (9)
  #  ## Optional name of the Secret ADC creates from a local file.
    secretName: impala-ca
  #  externalSecretName: existing-ca-secret
  #
  #  # Key in the Secret containing the CA certificate.
    certificateKey: ldap-ca.pem
  #
  #  ## Local files 'adc apply' puts into the Secret named by ca.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: /etc/ssl/ldap-ca.pem

  ## Controls whether Secret/ConfigMap changes restart pods.
  ## Set enabled: false to update referenced Secrets without restarting
  ## the workload; pods keep running the previous configuration until
  ## the policy is re-enabled. Defaults to enabled.
  #configurationRollout:
  #  enabled: false
    1 Namespace that the Impala cluster will use.
    2 Settings for pulling the Impala cluster image.
    3 Hadoop settings that were taken from the previously created hadoop_conf.yaml.
    4 URL for LDAP connection.
    5 User bind pattern.
    6 SSL settings.
    7 TLS settings.
    8 Web TLS settings.
    9 CA settings. 
    apiVersion: adc.arenadata.io/v1alpha1
kind: ImpalaCluster
metadata:
  name: impala
  namespace: impala (1)
spec:
  image: hub.arenadata.io/adc-enterprise/impala:<tag> (2)

  ## Image pull secret for a private registry.
  ## Set 'externalSecretName' to reference an existing Secret,
  ## or set 'credentials' and optionally 'secretName' to let the CLI create one.
  #imagePullSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-registry-secret
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-registry-secret
  #
  #  #credentials:
  #  #  registry: registry.example.com
  #  #  username: user
  #  #  password: pass

  hadoop: (3)
    core:
      fs.defaultFS: s3a://demo-s3
      fs.s3a.access.key: p.petrov@RU-CENTRAL1.INTERNAL
      fs.s3a.impl: org.apache.hadoop.fs.s3a.S3AFileSystem
      fs.s3a.secret.key: 3ab197f82fac43374519b4ad3015a76c778acf51897cf73f409ecba827e64255
    hive:
      fs.s3a.endpoint: http://adh-ctrl-nia-02.ru-central1.internal:9879
      fs.s3a.path.style.access: "true"
      hive.metastore.uris: thrift://hms-adh-nia-01.ru-central1.internal:9083
      hive.metastore.warehouse.dir: s3a://demo-s3/apps/hive/warehouse
      metastore.truststore.password: bigdata
      metastore.truststore.path: /etc/ssl/truststore.jks
      metastore.use.SSL: "true"

  ## Kerberos configuration for authentication.
  #kerberos:
  #  realm: EXAMPLE.COM
  #
  #  # Service name in the Kerberos principal. Defaults to the product name.
  #  service: impala
  #
  #  # Hostname in the Kerberos principal.
  #  # Required for a fixed service principal; leave it empty only to derive one principal per pod from the cluster domain.
  #  hostname: kerberos.example.com
  #  keytab:
  #    # true - kerberos-operator creates the keytab Secret.
  #    # false (default) - reference an existing keytab Secret with name keytab.secretName.
  #    create: false
  #
  #    # Name of the keytab Secret.
  #    # Optional when create: true - names the generated Secret (default: <name>-keytab).
  #    # Required when create: false - must reference an existing Secret.
  #    secretName: kerberos-secret
  #
  #    # Label selector for the Pod that generates the keytab.
  #    # Required when create: true; ignored when create: false.
  #    labelSelector:
  #      env: prod
  #    #additionalPrincipals:
  #    #  - HTTP/kerberos.example.com
  #
  #    clusterDomain: cluster.local
  #    rotation:
  #      interval: 24h
  #      checkInterval: 1h

  ## LDAP authentication configuration.
  ## Uncomment and fill url and userBindPattern.
  ## For ldaps:// URLs the ssl: or ca: section must also be configured (depends on product)
  ldap:
  #  # LDAP service url.
    url: ldaps://ad01.adsw.io:636 (4)
  #
  #  # LDAP user Bind pattern.
    userBindPattern: cn=#UID,OU=kerberos,OU=adh,DC=ad,DC=ranger-test (5)

  ## Ranger plugin configuration.
  ## Uncomment and fill the lines below. adc apply derives the rest.
  #ranger:
  #  # fill ranger.plugin.impala.policy.rest.url below with Ranger endpoint, e.g. https://adps-adc.ru-central1.internal:6182
  #  # fill ranger.plugin.impala.service.name below with Ranger service name you want to use for product, e.g. adc_impala_id_1
  #  security:
  #    ranger.plugin.impala.policy.rest.url: ""
  #    ranger.plugin.impala.service.name: ""
  #
  #  # fill xasecure.audit.destination.solr.zookeepers below with Zookeepers endpoints to resolve solr service, e.g. adps-adc.ru-central1.internal:2181/Arenadata.Hadoop-2.solr.server
  #  audit:
  #    xasecure.audit.destination.solr.zookeepers: ""
  #
  #  # Local Ranger files 'adc apply' writes into the configs Secret.
  #  # Relative paths are resolved against the config file.
  #  files:
  #    jceksStorePath: /path/to/ranger.jceks

  ## Java KeyStore/TrustStore certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  ssl: (6)
  #  ## Name of the Secret containing Java keystores.
    secretName: ssl-secret
  #  externalSecretName: existing-ssl-secret
  #
  #  # Key in the Secret containing the truststore file.
    trustStoreKey: truststore.jks
  #
  #  ## Password for the truststore (optional).
    trustStorePassword: bigdata
  #
  #  ## Key in the Secret containing the keystore file (optional).
  #  #keyStoreKey: keystore.jks
  #
  #  ## Password for the keystore (optional).
  #  #keyStorePassword: bigdata
  #
  #  ## Local files 'adc apply' puts into the Secret named by ssl.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      trustStorePath: /etc/ssl/truststore.jks
  #  #  #keyStorePath: /path/to/keystore.jks

  ## Use an external complete configs Secret instead of the one rendered by ADC.
  #configsSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-impala-configs
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-impala-configs

  catalog:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  coordinator:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  executor:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  statestore:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata

  ## Monitoring configuration.
  #monitoring:
  #  # Enables Prometheus metrics export from this product's pods.
  #  exportMetrics: true

  ## Admission-control resource pools. Rendered into a coordinator-only Secret (fair-scheduler.xml and optional llama-site.xml) mounted at /opt/impala/resource-pools.
  #resourcePools:
  #  # Fair-scheduler queue tree and placement policy, rendered to fair-scheduler.xml.
  #  allocations:
  #    # Queue tree, rooted at a single queue.
  #    queues:
  #      - aclSubmitApps: ' '
  #        name: root
  #        queues:
  #        - aclSubmitApps: '*'
  #          maxResources:
  #            memory: 50000
  #            vcores: 0
  #          name: default
  #          type: leaf
  #        type: parent
  #
  #    # Rules that route an incoming query to a queue.
  #    queuePlacementPolicy:
  #      rules:
  #        - create: false
  #          name: specified
  #        - name: default
  #
  #  # Raw llama-site.xml properties, rendered verbatim in list order.
  #  llamaProperties:
  #    # List of name/value pairs written to llama-site.xml.
  #    properties:
  #      - name: llama.am.throttling.maximum.placed.reservations.root.default
  #        value: "10"

  ## TLS certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  tls: (7)
  #  ## Optional name of the Secret ADC creates from local files.
    secretName: custom-tls-secret
  #  externalSecretName: existing-tls-secret
  #
  #  # Key in the Secret containing the TLS certificate.
    certificateKey: tls.crt
  #
  #  # Key in the Secret containing the TLS private key.
    privateKey: tls.key
  #
  #  ## Key in the Secret containing the client CA certificate.
  #  #clientCaCertificate: ca.crt
  #
  #  ## Local files 'adc apply' puts into the Secret named by tls.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: impala-jdbc.ru-central1.internal.crt
      privateKeyPath: impala-jdbc.ru-central1.internal.key
  #  #  #clientCaCertificatePath: /path/to/ca.crt

  ## TLS certificate configuration for web UI and HTTP endpoints.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  webTLS: (8)
  #  ## Optional name of the Secret ADC creates from local files.
    secretName: web-tls-secret
  #  externalSecretName: existing-web-tls-secret
  #
  #  # Key in the Secret containing the web TLS certificate.
    certificateKey: tls.crt
  #
  #  # Key in the Secret containing the web TLS private key.
    privateKey: tls.key
  #
  #  ## Local files 'adc apply' puts into the Secret named by webTLS.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: impala-cloud.ru-central1.internal.crt
      privateKeyPath: impala-cloud.ru-central1.internal.key

  ## CA certificate configuration for Impala.
  ## Set externalSecretName, or let ADC create a Secret from files.
  ca: (9)
  #  ## Optional name of the Secret ADC creates from a local file.
    secretName: impala-ca
  #  externalSecretName: existing-ca-secret
  #
  #  # Key in the Secret containing the CA certificate.
    certificateKey: ldap-ca.pem
  #
  #  ## Local files 'adc apply' puts into the Secret named by ca.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: /etc/ssl/ldap-ca.pem

  ## Controls whether Secret/ConfigMap changes restart pods.
  ## Set enabled: false to update referenced Secrets without restarting
  ## the workload; pods keep running the previous configuration until
  ## the policy is re-enabled. Defaults to enabled.
  #configurationRollout:
  #  enabled: false
    1 Namespace that the Impala cluster will use.
    2 Settings for pulling the Impala cluster image.
    3 Hadoop settings that were taken from the previously created hadoop_conf.yaml.
    4 URL for LDAP connection.
    5 User bind pattern.
    6 SSL settings.
    7 TLS settings.
    8 Web TLS settings.
    9 CA settings.

  4. If you use Impala with Ranger, update the Ranger configuration according to the instruction.

  5. Apply the configuration:

    $ ./adc apply -f impala-cluster.yaml

    The expected output contains a confirmation of success:

    time="20260518133858UTC" level="info" msg="cluster impala applied to namespace impala"

  6. Delete old pods so that Impala operator creates new ones from an updated config:

    $ kubectl delete pods -n <impala-cluster-ns> -l app.kubernetes.io/instance=impala-cluster

  7. Verify the Impala cluster pods:

    $ kubectl get pods -n impala

    The expected output is:

    NAME                   READY   STATUS    RESTARTS   AGE
impala-catalog-0       1/1     Running   0          5s
impala-coordinator-0   1/1     Running   0          5s
impala-executor-0      1/1     Running   0          5s
impala-statestore-0    1/1     Running   0          5s

Step 2. Check the JDBC connection

  1. Connect to the Impala cluster over JDBC, for example, using DBeaver. After enabling LDAP and SSL, the JDBC connection string looks as follows:

    jdbc:impala://impala-jdbc.ru-central1.internal:21050/default;AuthMech=3;UID=<UID>;PWD=<PWD>;SSL=1;SSLTrustStore=<SSLTrustStore>;SSLTrustStorePwd=<SSLTrustStorePwd>;httpPath=cliservice

    where:

    • <UID> — username of a user in LDAP.

    • <PWD> — password of a user in LDAP.

    • <SSLTrustStore> — path to the truststore with certificates used by DBeaver.

    • <SSLTrustStorePwd> — password for accessing the truststore.

  2. Once connected, verify the Impala cluster operability:

    SHOW DATABASES;

    The expected output:

    name            |comment                                     |
----------------+--------------------------------------------+
_impala_builtins|System database for Impala builtin functions|
default         |Default Hive database                       |
Found a mistake? Seleсt text and press Ctrl+Enter to report it