Configure LDAP and SSL for Impala on Kubernetes using Helm

Sergei Tikhomirov

Prerequisites

  • An ADH cluster (4.2.0 or later) is installed.

  • Impala is deployed in Kubernetes according to the instruction.

  • SSL is enabled for the ADH cluster. This step is optional but recommended for security purposes. This guide presumes that this step was completed.

To access Impala web UI and allow JDBC connections, generate certificates for Ingress and load balancer:

$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout impala-cloud.ru-central1.internal.key -out impala-cloud.ru-central1.internal.crt -subj "/CN=impala-cloud.ru-central1.internal"
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout impala-jdbc.ru-central1.internal.key -out impala-jdbc.ru-central1.internal.crt -subj "/CN=impala-jdbc.ru-central1.internal"
NOTE
The Kerberos and LDAP authentications are mutually exclusive. Attempting to provide both configurations at the same time will result in the Helm chart rejection.

Step 1. Update Kubernetes secrets

  1. Create a secret for the truststore:

    $ kubectl create secret generic ca-store -n <impala-cluster-ns> --from-file=truststore.jks=/etc/ssl/truststore.jks

  2. Create a secret for incoming JDBC connections:

    $ kubectl create secret generic impala-tls -n <impala-cluster-ns> --from-file=cert.crt=impala-jdbc.ru-central1.internal.crt --from-file=crt.key=impala-jdbc.ru-central1.internal.key

  3. Create a secret for the CA certificate:

    $ kubectl create secret generic impala-ca -n <impala-cluster-ns> --from-file=ldap-ca.pem=<ca_cert>

    where <ca_cert> is a path to the CA certificate, e.g. /etc/ssl/ldap-ca.pem.

  4. Create a secret for web TLS:

    $ kubectl create secret generic web-tls-secret -n <impala-cluster-ns> --from-file=cert.crt=impala-cloud.ru-central1.internal.crt --from-file=crt.key=impala-cloud.ru-central1.internal.key

  5. Adjust the hive-site.xml configuration file. The updated version should include the properties as shown below:

    hive-site.xml
    <?xml version="1.0"?>
<configuration>
    <property>
	<name>hive.metastore.uris</name>
        <value>thrift://tsn-adh-k8s-1.ru-central1.internal:9083</value>
    </property>
    <property>
        <name>metastore.use.SSL</name>
        <value>True</value>
    </property>
    <property>
	<name>metastore.truststore.password</name>
	<value>bigdata</value>
    </property>
    <property>
        <name>metastore.truststore.path</name>
	<value>/etc/ssl/truststore.jks</value>
    </property>
    <property>
        <name>hive.metastore.sasl.enabled</name>
        <value>False</value>
    </property>
</configuration>

  6. If you use Impala with Ranger, update the Ranger configuration according to the instruction.

  7. Re-create the Kubernetes secret:

    $ kubectl delete secret <hadoop-conf> -n <impala-cluster-ns>
$ kubectl create secret generic <hadoop-conf> -n <impala-cluster-ns> --from-file=core-site.xml --from-file=hdfs-site.xml --from-file=hive-site.xml

    where:

    • <hadoop-conf> is the name of the Kubernetes secret with ADH configs.

    • <impala-cluster-ns> is the namespace used by Impala.

Step 2. Update the Impala cluster configuration

  1. Modify the impala_cluster_values.yaml configuration file by adding the LDAP, SSL, TLS, CA, and web TLS blocks to it. The updated file should look as follows:

    impala_cluster_values.yaml
    image:
  registry: <registry>
  repository: <repository>
  tag: <tag>
  pullSecret:
    name: ""
    ## List of secrets to create for image pulling in all product namespaces
    credentials: {}
#      registry: private-docker-registry
#      username: user
#      password: pass

useRanger: false
clusterDomain: cluster.local
configsSecretName: "hadoop-conf"

ldap:
  enabled: true
  url: <ldap_url> (1)
  userBindPattern: <bind_pattern> (2)

ssl: (3)
  secretName: ca-store
  trustStoreKey: truststore.jks
  trustStorePassword: bigdata

tls: (4)
  secretName: impala-tls
  certificateKey: cert.crt
  privateKey: crt.key

webTLS: (5)
  secretName: web-tls-secret
  certificateKey: cert.crt
  privateKey: crt.key

ca: (6)
  secretName: impala-ca
  certificateKey: ldap-ca.pem

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

catalog:

coordinator:

executor:
  replicas: 2

statestore:
    1 URL for LDAP connection, e.g. ldaps://ad01.adsw.io:636.
    2 User bind pattern, e.g. cn=#UID,cn=Peoples,dc=ad,dc=ranger-test.
    3 SSL settings.
    4 TLS settings.
    5 Web TLS settings.
    6 CA settings.

  2. Update the Impala cluster information:

    $ helm upgrade --install impala-cluster oci://"$PRIVATE_REGISTRY"/adc-enterprise/charts/impala-cluster --version <version> -f impala_cluster_values.yaml --namespace <impala-cluster-ns> --create-namespace

  3. Delete old pods so that Impala operator creates new ones from an updated config:

    $ kubectl delete pods -n <impala-cluster-ns> -l app.kubernetes.io/instance=impala-cluster

  4. Check that all the pods are in the Running state:

    $ kubectl get pods -n <impala-cluster-ns>

    The expected output is:

    NAME                           READY   STATUS    RESTARTS   AGE
impala-cluster-catalog-0       1/1     Running   0          5s
impala-cluster-coordinator-0   1/1     Running   0          5s
impala-cluster-executor-0      1/1     Running   0          5s
impala-cluster-executor-1      1/1     Running   0          5s
impala-cluster-statestore-0    1/1     Running   0          5s

Step 3. Check the JDBC connection

  1. Connect to the Impala cluster over JDBC, for example, using DBeaver. After enabling LDAP and SSL, the JDBC connection string looks as follows:

    jdbc:impala://impala-jdbc.ru-central1.internal:21050/default;AuthMech=3;UID=<UID>;PWD=<PWD>;SSL=1;SSLTrustStore=<SSLTrustStore>;SSLTrustStorePwd=<SSLTrustStorePwd>;httpPath=cliservice

    where:

    • <UID> — username of a user in LDAP.

    • <PWD> — password of a user in LDAP.

    • <SSLTrustStore> — path to the truststore with certificates used by DBeaver.

    • <SSLTrustStorePwd> — password for accessing the truststore.

  2. Once connected, verify the Impala cluster operability:

    SHOW DATABASES;

    The expected output:

    name            |comment                                     |
----------------+--------------------------------------------+
_impala_builtins|System database for Impala builtin functions|
default         |Default Hive database                       |
Found a mistake? Seleсt text and press Ctrl+Enter to report it