Главная
Arenadata Hyperwave
Сервисы
Impala
Интеграция
Kubernetes
Arenadata Cloud CLI
Настройка Kerberos и SSL для Impala в Kubernetes

Настройка Kerberos и SSL для Impala в Kubernetes с помощью CLI

Сергей Тихомиров

Свернуть контент Развернуть контент

Содержание

Требования
Шаг 1. Установка оператора Kerberos
Шаг 2. Обновление конфигурации кластера Impala
Шаг 3. Проверка JDBC-соединения
Удаление инстансов

Требования

Установленный и керберизированный кластер ADH версии 4.2.0 или более поздней.
Кластер Impala, развернутый в Kubernetes согласно инструкции.
SSL активирован для кластера ADH.

Для доступа к веб-интерфейсу Impala и JDBC-соединений сгенерируйте сертификаты для Ingress и балансировщика нагрузки:

$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout impala-cloud.ru-central1.internal.key -out impala-cloud.ru-central1.internal.crt -subj "/CN=impala-cloud.ru-central1.internal"
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout impala-jdbc.ru-central1.internal.key -out impala-jdbc.ru-central1.internal.crt -subj "/CN=impala-jdbc.ru-central1.internal"

ПРИМЕЧАНИЕ

Методы аутентификации Kerberos и LDAP являются взаимоисключающими.

Шаг 1. Установка оператора Kerberos

Извлеките и загрузите образ оператора Kerberos в ваш репозиторий.
Инициализируйте оператор Kerberos:
```
$ ./adc init --kerberos-operator -o kerberos-operator.yaml
```
Данная команда создаст файл kerberos-operator.yaml с шаблоном конфигурации.

Отредактируйте конфигурационный файл:

kerberos-operator.yaml

apiVersion: adc.arenadata.io/v1alpha1
kind: KerberosOperator
metadata:
  name: kerberos-operator
  namespace: kerberos-operator (1)
spec:
  image: hub.arenadata.io/adc-enterprise/kerberos-operator:<tag> (2)

  # Number of replicas
  # replicas: 1

  resources:
    limits:
      cpu: 500m
      memory: 256Mi

  # Operator ServiceAccount. create: true (default) also creates the manager and per-payload-namespace Role/RoleBinding bound to it; create: false skips all three - name then refers to a ServiceAccount (and RBAC) managed entirely outside the CLI.
  serviceAccount: (3)
    create: true
    name: "kerberos-operator"

  # Whether the CLI creates the product namespace.
  # The namespace name is set in metadata.namespace.
  namespace:
    create: true

  # Create namespaces to run the payload.
  createPayloadNamespaces: true

  # List of namespaces to run the payload in.
  payloadNamespaces: (4)
    - impala

  ## Image pull secret for a private registry.
  ## Set 'externalSecretName' to reference an existing Secret,
  ## or set 'credentials' and optionally 'secretName' to let the CLI create one.
  #imagePullSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-registry-secret
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-registry-secret
  #
  #  #credentials:
  #  #  registry: registry.example.com
  #  #  username: user
  #  #  password: pass

  ## Operator monitoring configuration. Supports product-specific metrics export and optional vmagent delivery to an external ADM.
  #monitoring:
  #  # Expose the Kerberos operator metrics endpoint on port 8443.
  #  exportMetrics: true
  #
  #  # Renders a namespace-scoped vmagent that sends metrics to an external ADM.
  #  vmagent:
  #    remoteWrite:
  #      url: http://vminsert.example.com/insert/0/prometheus/api/v1/write
  #    scrapeInterval: 15s
  #    image: hub.arenadata.io/adm-enterprise/vmagent:1.136.0-adm-5.0.0-x86_64
  #
  #    ## HTTPS settings used by vmagent when scraping product metrics.
  #    #tls:
  #    #  ## CA certificate source used to verify the metrics endpoint.
  #    #  #ca:
  #    #  #  # Use a Secret managed outside ADC.
  #    #  #  externalSecretName: existing-product-metrics-ca
  #    #  #
  #    #  #  ## Or let ADC create the Secret.
  #    #  #  #secretName: product-metrics-ca
  #    #  #
  #    #  #  # Key containing the CA certificate in the referenced Secret.
  #    #  #  certificateKey: ca.crt
  #    #  #
  #    #  #  ## Local CA certificate read by ADC to create the configured Secret.
  #    #  #  #files:
  #    #  #  #  certificatePath: /path/to/ca.crt
  #    #
  #    #  ## Server name used to verify the metrics endpoint certificate hostname.
  #    #  #serverName: metrics.example.com
  #    #
  #    #  # Skip verification of the metrics endpoint certificate. Do not use together with ca.
  #    #  insecureSkipVerify: true

  ## TLS certificate configuration for metrics endpoint.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  #metricsTLS:
  #  ## Optional name of the Secret ADC creates from local files.
  #  #secretName: custom-metrics-tls-secret
  #  externalSecretName: existing-metrics-tls-secret
  #
  #  # Key in the Secret containing the TLS certificate.
  #  certificateKey: tls.crt
  #
  #  # Key in the Secret containing the TLS private key.
  #  privateKey: tls.key
  #
  #  ## Local files 'adc apply' puts into the Secret named by metricsTLS.secretName.
  #  ## Relative paths are resolved against the config file.
  #  #files:
  #  #  certificatePath: /path/to/tls.crt
  #  #  privateKeyPath: /path/to/tls.key

  ## Defines the Kerberos realm configuration and krb5.conf-related settings.
  kdc: (5)
    realm: AD.RANGER-TEST
    labelSelector:
      env: prod
    realms:
      AD.RANGER-TEST: |-
        kdc = ad01.adsw.io
        admin_server = ad01.adsw.io
    domainRealm:
      ad.ranger-test: AD.RANGER-TEST
    libdefaults:
  #    debug: "false"
      default_realm: AD.RANGER-TEST
  #    default_tgs_enctypes: aes256-cts-hmac-sha1-96
  #    dns_lookup_kdc: "false"

  ## Defines connection and authentication details for the LDAP server (backend for Kerberos KDC).
  ldapSecret: (6)
    secretName: ldap-credentials
    provider: ad
    address: ldaps://ad01.adsw.io:636
    adminUser: stikhomirov@AD.RANGER-TEST
    adminPassword: <password>
    baseDN: OU=stikhomirov_ou,OU=kerberos,OU=adh,DC=ad,DC=ranger-test
    ca: "" (7)
  #
  #  # Local file paths consumed by the CLI during 'adc apply'.
  #  # Paths are relative to the config file. The CLI reads this file
  #  # and creates the Secret named by ldapSecret.secretName.
  #  files:
  #    certificatePath: /path/to/ca.pem

1	Настройки пространства имен.
2	URL образа оператора Kerberos в вашем репозитории.
3	Настройки сервисного аккаунта.
4	Список пространств имен, доступных оператору Kerberos.
5	Настройки KDC.
6	Настройки LDAP. Если вы не используете SSL, замените протокол на `ldap` и порт на `389`.
7	CA-сертификат в формате PEM, необходимый, если LDAP защищен SSL.

Вы можете проверить конфигурацию перед ее применением, выполнив команду apply с флагом --dry-run:

$ ./adc apply -f kerberos-operator.yaml --dry-run > kerberos-operator-render.yaml

kerberos-operator-render.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: kerberos-operator
spec: {}
status: {}
---
apiVersion: v1
kind: Namespace
metadata:
  name: impala
spec: {}
status: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kerberos-operator
  namespace: kerberos-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kerberos-operator-kerberos-operator-manager
  namespace: kerberos-operator
rules:
- apiGroups:
  - events.k8s.io
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - kdcconfigs
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - kdcconfigs/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - krb5.arenadata.io
  resources:
  - kdcconfigs/finalizers
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kerberos-operator-kerberos-operator-manager
  namespace: kerberos-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kerberos-operator-kerberos-operator-manager
subjects:
- kind: ServiceAccount
  name: kerberos-operator
  namespace: kerberos-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kerberos-operator-kerberos-operator-payload
  namespace: impala
rules:
- apiGroups:
  - events.k8s.io
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - keytabs
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - keytabs/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - krb5.arenadata.io
  resources:
  - keytabs/finalizers
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kerberos-operator-kerberos-operator-payload
  namespace: impala
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kerberos-operator-kerberos-operator-payload
subjects:
- kind: ServiceAccount
  name: kerberos-operator
  namespace: kerberos-operator
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: operator
    app.kubernetes.io/managed-by: adc-cli
    arenadata.io/operator-type: kerberos
  name: kerberos-operator-kerberos-operator
  namespace: kerberos-operator
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: operator
      app.kubernetes.io/managed-by: adc-cli
      app.kubernetes.io/name: kerberos-operator-kerberos-operator
  strategy: {}
  template:
    metadata:
      labels:
        app.kubernetes.io/component: operator
        app.kubernetes.io/managed-by: adc-cli
        app.kubernetes.io/name: kerberos-operator-kerberos-operator
    spec:
      containers:
      - args:
        - -ns=impala
        image: hub.arenadata.io/adc-enterprise/kerberos-operator:<tag>
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        name: app
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            cpu: 500m
            memory: 256Mi
          requests:
            cpu: 500m
            memory: 256Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsGroup: 10001
          runAsNonRoot: true
          runAsUser: 10001
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      serviceAccountName: kerberos-operator
      terminationGracePeriodSeconds: 10
status: {}
---
apiVersion: krb5.arenadata.io/v1alpha1
kind: KDCConfig
metadata:
  name: kerberos-operator-kdc
  namespace: kerberos-operator
spec:
  domainRealm:
    ad.ranger-test: AD.RANGER-TEST
  labelSelector:
    env: prod
  libdefaults:
    default_realm: AD.RANGER-TEST
  realm: AD.RANGER-TEST
  realms:
    AD.RANGER-TEST: |-
      kdc = ad01.adsw.io
      admin_server = ad01.adsw.io
---
apiVersion: v1
kind: Secret
metadata:
  annotations:
    krb5.arenadata.io/provider: ad
  labels:
    env: prod
  name: ldap-credentials
  namespace: kerberos-operator
stringData:
  addr: ldaps://ad01.adsw.io:636
  adminDN: stikhomirov@AD.RANGER-TEST
  adminPW: <password>
  baseDN: OU=stikhomirov_ou,OU=kerberos,OU=adh,DC=ad,DC=ranger-test
type: krb5.arenadata.io/ldap-credentials

Если манифест корректный, примените конфигурацию и разверните оператор Kerberos:
```
$ ./adc apply -f kerberos-operator.yaml
```

Шаг 2. Обновление конфигурации кластера Impala

Подготовьте новую версию файла hadoop_conf.yaml с настройками Hadoop:

hadoop_conf.yaml

HDFS
S3

sites:
  core:
    fs.defaultFS: hdfs://adh
    hadoop.security.authentication: kerberos
    dfs.client.failover.proxy.provider.adh: org.apache.hadoop.hdfs.server.namenode.ha.ObserverReadProxyProvider
    dfs.ha.namenodes.adh: nn_tsn-adh-k8s-1,nn_tsn-adh-k8s-3
    dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:8020
    dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:8020
    dfs.nameservices: adh
    dfs.namenode.kerberos.principal: hdfs-namenode/_HOST@AD.RANGER-TEST
    dfs.journalnode.kerberos.principal: hdfs-journalnode/_HOST@AD.RANGER-TEST
    dfs.datanode.kerberos.principal: hdfs-datanode/_HOST@AD.RANGER-TEST
    hadoop.ssl.enabled: true
  hdfs:
    dfs.client.read.shortcircuit: false
  ozone:
    ozone.om.address.adh.om_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:9862
    ozone.om.address.adh.om_tsn-adh-k8s-2: tsn-adh-k8s-2.ru-central1.internal:9862
    ozone.om.address.adh.om_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:9862
    ozone.om.nodes.adh: om_tsn-adh-k8s-1,om_tsn-adh-k8s-2,om_tsn-adh-k8s-3
    ozone.om.kerberos.principal: om/_HOST@AD.RANGER-TEST
    ozone.om.service.ids: adhom
  hive:
    hive.metastore.sasl.enabled: true
    hive.metastore.uris: thrift://tsn-adh-k8s-1.ru-central1.internal:9083
    hive.metastore.kerberos.principal: hive/_HOST@AD.RANGER-TEST
    metastore.use.SSL: true

sites:
  core:
    hadoop.security.authentication: kerberos
    fs.defaultFS: s3a://demo-s3
    fs.s3a.impl: org.apache.hadoop.fs.s3a.S3AFileSystem
    fs.s3a.access.key: p.petrov@RU-CENTRAL1.INTERNAL
    fs.s3a.secret.key: 3ab197f82fac43374519b4ad3015a76c778acf51897cf73f409ecba827e64255
  hive:
    hive.metastore.uris: thrift://hms-adh-nia-01.ru-central1.internal:9083
    metastore.use.SSL: true
    hive.metastore.sasl.enabled: true
    hive.metastore.kerberos.principal: hive/_HOST@AD.RANGER-TEST
    fs.s3a.endpoint: http://adh-ctrl-nia-02.ru-central1.internal:9879
    fs.s3a.path.style.access: true
    hive.metastore.warehouse.dir: s3a://demo-s3/apps/hive/warehouse

Инициализируйте кластер Impala:
```
$ ./adc init --impala-cluster --hadoop-file hadoop_conf.yaml -o impala-cluster.yaml
```
Данная операция создаст файл impala-cluster.yaml с шаблоном конфигурации.

Отредактируйте конфигурационный файл:

impala-cluster.yaml

HDFS
S3

apiVersion: adc.arenadata.io/v1alpha1
kind: ImpalaCluster
metadata:
  name: impala
  namespace: impala (1)
spec:
  image: hub.arenadata.io/adc-enterprise/impala:<tag> (2)

  ## Image pull secret for a private registry.
  ## Set 'externalSecretName' to reference an existing Secret,
  ## or set 'credentials' and optionally 'secretName' to let the CLI create one.
  #imagePullSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-registry-secret
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-registry-secret
  #
  #  #credentials:
  #  #  registry: registry.example.com
  #  #  username: user
  #  #  password: pass

  hadoop: (3)
    core:
      dfs.client.failover.proxy.provider.adh: org.apache.hadoop.hdfs.server.namenode.ha.ObserverReadProxyProvider
      dfs.datanode.kerberos.principal: hdfs-datanode/_HOST@AD.RANGER-TEST
      dfs.ha.namenodes.adh: nn_tsn-adh-k8s-1,nn_tsn-adh-k8s-3
      dfs.journalnode.kerberos.principal: hdfs-journalnode/_HOST@AD.RANGER-TEST
      dfs.namenode.kerberos.principal: hdfs-namenode/_HOST@AD.RANGER-TEST
      dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:8020
      dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:8020
      dfs.nameservices: adh
      fs.defaultFS: hdfs://adh
      hadoop.security.authentication: kerberos
      hadoop.ssl.enabled: "true"
    hdfs:
      dfs.client.read.shortcircuit: "false"
    hive:
      hive.metastore.kerberos.principal: hive/_HOST@AD.RANGER-TEST
      hive.metastore.sasl.enabled: "true"
      hive.metastore.uris: thrift://tsn-adh-k8s-1.ru-central1.internal:9083
      metastore.truststore.password: bigdata
      metastore.truststore.path: /etc/ssl/truststore.jks
      metastore.use.SSL: "true"
    ozone:
      ozone.om.address.adh.om_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:9862
      ozone.om.address.adh.om_tsn-adh-k8s-2: tsn-adh-k8s-2.ru-central1.internal:9862
      ozone.om.address.adh.om_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:9862
      ozone.om.kerberos.principal: om/_HOST@AD.RANGER-TEST
      ozone.om.nodes.adh: om_tsn-adh-k8s-1,om_tsn-adh-k8s-2,om_tsn-adh-k8s-3
      ozone.om.service.ids: adhom

  ## Kerberos configuration for authentication.
  kerberos: (4)
    realm: AD.RANGER-TEST
  #
  #  # Service name in the Kerberos principal. Defaults to the product name.
    service: impala
  #
  #  # Hostname in the Kerberos principal.
  #  # Required for a fixed service principal; leave it empty only to derive one principal per pod from the cluster domain.
    hostname: impala-jdbc.ru-central1.internal
    keytab: (5)
  #    # true - kerberos-operator creates the keytab Secret.
  #    # false (default) - reference an existing keytab Secret with name keytab.secretName.
      create: true
  #
  #    # Name of the keytab Secret.
  #    # Optional when create: true - names the generated Secret (default: <name>-keytab).
  #    # Required when create: false - must reference an existing Secret.
      secretName: kerberos-secret
  #
  #    # Label selector for the Pod that generates the keytab.
  #    # Required when create: true; ignored when create: false.
      labelSelector:
        env: prod
      additionalPrincipals:
        - HTTP/impala-cloud.ru-central1.internal
        - impala/impala-cloud.ru-central1.internal
        - impala/impala-jdbc.ru-central1.internal
  #
  #    clusterDomain: cluster.local
      rotation:
        interval: 24h
        checkInterval: 1h

  ## LDAP authentication configuration.
  ## Uncomment and fill url and userBindPattern.
  ## For ldaps:// URLs the ssl: or ca: section must also be configured (depends on product)
  #ldap:
  #  # LDAP service url.
  #  url: ldaps://ldap.example.com:636
  #
  #  # LDAP user Bind pattern.
  #  userBindPattern: uid=#UID,cn=users,dc=example,dc=com

  ## Ranger plugin configuration.
  ## Uncomment and fill the lines below. adc apply derives the rest.
  #ranger:
  #  # fill ranger.plugin.impala.policy.rest.url below with Ranger endpoint, e.g. https://adps-adc.ru-central1.internal:6182
  #  # fill ranger.plugin.impala.service.name below with Ranger service name you want to use for product, e.g. adc_impala_id_1
  #  security:
  #    ranger.plugin.impala.policy.rest.url: ""
  #    ranger.plugin.impala.service.name: ""
  #
  #  # fill xasecure.audit.destination.solr.zookeepers below with Zookeepers endpoints to resolve solr service, e.g. adps-adc.ru-central1.internal:2181/Arenadata.Hadoop-2.solr.server
  #  audit:
  #    xasecure.audit.destination.solr.zookeepers: ""
  #
  #  # Local Ranger files 'adc apply' writes into the configs Secret.
  #  # Relative paths are resolved against the config file.
  #  files:
  #    jceksStorePath: /path/to/ranger.jceks

  ## Java KeyStore/TrustStore certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  ssl: (6)
  #  ## Name of the Secret containing Java keystores.
    secretName: ssl-secret
  #  externalSecretName: existing-ssl-secret
  #
  #  # Key in the Secret containing the truststore file.
    trustStoreKey: truststore.jks
  #
  #  ## Password for the truststore (optional).
    trustStorePassword: bigdata
  #
  #  ## Key in the Secret containing the keystore file (optional).
  #  #keyStoreKey: keystore.jks
  #
  #  ## Password for the keystore (optional).
  #  #keyStorePassword: bigdata
  #
  #  ## Local files 'adc apply' puts into the Secret named by ssl.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      trustStorePath: /etc/ssl/truststore.jks
  #  #  #keyStorePath: /path/to/keystore.jks

  ## Use an external complete configs Secret instead of the one rendered by ADC.
  #configsSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-impala-configs
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-impala-configs

  catalog:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  coordinator:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  executor:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  statestore:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata

  ## Monitoring configuration.
  #monitoring:
  #  # Enables Prometheus metrics export from this product's pods.
  #  exportMetrics: true

  ## Admission-control resource pools. Rendered into a coordinator-only Secret (fair-scheduler.xml and optional llama-site.xml) mounted at /opt/impala/resource-pools.
  #resourcePools:
  #  # Fair-scheduler queue tree and placement policy, rendered to fair-scheduler.xml.
  #  allocations:
  #    # Queue tree, rooted at a single queue.
  #    queues:
  #      - aclSubmitApps: ' '
  #        name: root
  #        queues:
  #        - aclSubmitApps: '*'
  #          maxResources:
  #            memory: 50000
  #            vcores: 0
  #          name: default
  #          type: leaf
  #        type: parent
  #
  #    # Rules that route an incoming query to a queue.
  #    queuePlacementPolicy:
  #      rules:
  #        - create: false
  #          name: specified
  #        - name: default
  #
  #  # Raw llama-site.xml properties, rendered verbatim in list order.
  #  llamaProperties:
  #    # List of name/value pairs written to llama-site.xml.
  #    properties:
  #      - name: llama.am.throttling.maximum.placed.reservations.root.default
  #        value: "10"

  ## TLS certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  tls: (7)
  #  ## Optional name of the Secret ADC creates from local files.
    secretName: tls-secret
  #  externalSecretName: existing-tls-secret
  #
  #  # Key in the Secret containing the TLS certificate.
    certificateKey: tls.crt
  #
  #  # Key in the Secret containing the TLS private key.
    privateKey: tls.key
  #
  #  ## Key in the Secret containing the client CA certificate.
  #  #clientCaCertificate: ca.crt
  #
  #  ## Local files 'adc apply' puts into the Secret named by tls.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: impala-jdbc.ru-central1.internal.crt
      privateKeyPath: impala-jdbc.ru-central1.internal.key
  #  #  #clientCaCertificatePath: /path/to/ca.crt

  ## TLS certificate configuration for web UI and HTTP endpoints.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  #webTLS:
  #  ## Optional name of the Secret ADC creates from local files.
  #  #secretName: custom-web-tls-secret
  #  externalSecretName: existing-web-tls-secret
  #
  #  # Key in the Secret containing the web TLS certificate.
  #  certificateKey: tls.crt
  #
  #  # Key in the Secret containing the web TLS private key.
  #  privateKey: tls.key
  #
  #  ## Local files 'adc apply' puts into the Secret named by webTLS.secretName.
  #  ## Relative paths are resolved against the config file.
  #  #files:
  #  #  certificatePath: /path/to/tls.crt
  #  #  privateKeyPath: /path/to/tls.key

  ## CA certificate configuration for Impala.
  ## Set externalSecretName, or let ADC create a Secret from files.
  #ca:
  #  ## Optional name of the Secret ADC creates from a local file.
  #  #secretName: custom-ca-secret
  #  externalSecretName: existing-ca-secret
  #
  #  # Key in the Secret containing the CA certificate.
  #  certificateKey: ca.crt
  #
  #  ## Local files 'adc apply' puts into the Secret named by ca.secretName.
  #  ## Relative paths are resolved against the config file.
  #  #files:
  #  #  certificatePath: /path/to/ca.pem

  ## Controls whether Secret/ConfigMap changes restart pods.
  ## Set enabled: false to update referenced Secrets without restarting
  ## the workload; pods keep running the previous configuration until
  ## the policy is re-enabled. Defaults to enabled.
  #configurationRollout:
  #  enabled: false

1	Пространство имен, используемое кластером Impala.
2	Настройки для загрузки образа кластера Impala.
3	Настройки Hadoop, взятые из ранее созданного файла hadoop_conf.yaml.
4	Настройки Kerberos.
5	Если параметр `keytab.create` имеет значение `true`, оператор Kerberos сгенерирует секрет с именем, указанным в параметре `keytab.secretName`; если параметр `keytab.secretName` не указан, имя секрета будет иметь формат `<metadata.name>-keytab`. Если параметр `keytab.create` имеет значение `false`, имеющийся секрет с именем `keytab.secretName` будет использован для получения keytab-файла.
6	Настройки SSL.
7	Настройки TLS.

apiVersion: adc.arenadata.io/v1alpha1
kind: ImpalaCluster
metadata:
  name: impala
  namespace: impala (1)
spec:
  image: hub.arenadata.io/adc-enterprise/impala:<tag> (2)

  ## Image pull secret for a private registry.
  ## Set 'externalSecretName' to reference an existing Secret,
  ## or set 'credentials' and optionally 'secretName' to let the CLI create one.
  #imagePullSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-registry-secret
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-registry-secret
  #
  #  #credentials:
  #  #  registry: registry.example.com
  #  #  username: user
  #  #  password: pass

  hadoop: (3)
    core:
      fs.defaultFS: s3a://demo-s3
      fs.s3a.access.key: p.petrov@RU-CENTRAL1.INTERNAL
      fs.s3a.impl: org.apache.hadoop.fs.s3a.S3AFileSystem
      fs.s3a.secret.key: 3ab197f82fac43374519b4ad3015a76c778acf51897cf73f409ecba827e64255
      hadoop.security.authentication: kerberos
    hive:
      fs.s3a.endpoint: http://adh-ctrl-nia-02.ru-central1.internal:9879
      fs.s3a.path.style.access: "true"
      hive.metastore.kerberos.principal: hive/_HOST@AD.RANGER-TEST
      hive.metastore.sasl.enabled: "true"
      hive.metastore.uris: thrift://hms-adh-nia-01.ru-central1.internal:9083
      hive.metastore.warehouse.dir: s3a://demo-s3/apps/hive/warehouse
      metastore.truststore.password: bigdata
      metastore.truststore.path: /etc/ssl/truststore.jks
      metastore.use.SSL: "true"

  ## Kerberos configuration for authentication.
  kerberos: (4)
    realm: AD.RANGER-TEST
  #
  #  # Service name in the Kerberos principal. Defaults to the product name.
    service: impala
  #
  #  # Hostname in the Kerberos principal.
  #  # Required for a fixed service principal; leave it empty only to derive one principal per pod from the cluster domain.
    hostname: impala-jdbc.ru-central1.internal
    keytab: (5)
  #    # true - kerberos-operator creates the keytab Secret.
  #    # false (default) - reference an existing keytab Secret with name keytab.secretName.
      create: true
  #
  #    # Name of the keytab Secret.
  #    # Optional when create: true - names the generated Secret (default: <name>-keytab).
  #    # Required when create: false - must reference an existing Secret.
      secretName: kerberos-secret
  #
  #    # Label selector for the Pod that generates the keytab.
  #    # Required when create: true; ignored when create: false.
      labelSelector:
        env: prod
      additionalPrincipals:
        - HTTP/impala-cloud.ru-central1.internal
        - impala/impala-cloud.ru-central1.internal
        - impala/impala-jdbc.ru-central1.internal
  #
  #    clusterDomain: cluster.local
      rotation:
        interval: 24h
        checkInterval: 1h

  ## LDAP authentication configuration.
  ## Uncomment and fill url and userBindPattern.
  ## For ldaps:// URLs the ssl: or ca: section must also be configured (depends on product)
  #ldap:
  #  # LDAP service url.
  #  url: ldaps://ldap.example.com:636
  #
  #  # LDAP user Bind pattern.
  #  userBindPattern: uid=#UID,cn=users,dc=example,dc=com

  ## Ranger plugin configuration.
  ## Uncomment and fill the lines below. adc apply derives the rest.
  #ranger:
  #  # fill ranger.plugin.impala.policy.rest.url below with Ranger endpoint, e.g. https://adps-adc.ru-central1.internal:6182
  #  # fill ranger.plugin.impala.service.name below with Ranger service name you want to use for product, e.g. adc_impala_id_1
  #  security:
  #    ranger.plugin.impala.policy.rest.url: ""
  #    ranger.plugin.impala.service.name: ""
  #
  #  # fill xasecure.audit.destination.solr.zookeepers below with Zookeepers endpoints to resolve solr service, e.g. adps-adc.ru-central1.internal:2181/Arenadata.Hadoop-2.solr.server
  #  audit:
  #    xasecure.audit.destination.solr.zookeepers: ""
  #
  #  # Local Ranger files 'adc apply' writes into the configs Secret.
  #  # Relative paths are resolved against the config file.
  #  files:
  #    jceksStorePath: /path/to/ranger.jceks

  ## Java KeyStore/TrustStore certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  ssl: (6)
  #  ## Name of the Secret containing Java keystores.
    secretName: ssl-secret
  #  externalSecretName: existing-ssl-secret
  #
  #  # Key in the Secret containing the truststore file.
    trustStoreKey: truststore.jks
  #
  #  ## Password for the truststore (optional).
    trustStorePassword: bigdata
  #
  #  ## Key in the Secret containing the keystore file (optional).
  #  #keyStoreKey: keystore.jks
  #
  #  ## Password for the keystore (optional).
  #  #keyStorePassword: bigdata
  #
  #  ## Local files 'adc apply' puts into the Secret named by ssl.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      trustStorePath: /etc/ssl/truststore.jks
  #  #  #keyStorePath: /path/to/keystore.jks

  ## Use an external complete configs Secret instead of the one rendered by ADC.
  #configsSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-impala-configs
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-impala-configs

  catalog:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  coordinator:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  executor:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  statestore:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: "2"
    #    memory: 8Gi
    #  requests:
    #    cpu: 300m
    #    memory: 384Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  redirect_stdout_stderr: "false"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata

  ## Monitoring configuration.
  #monitoring:
  #  # Enables Prometheus metrics export from this product's pods.
  #  exportMetrics: true

  ## Admission-control resource pools. Rendered into a coordinator-only Secret (fair-scheduler.xml and optional llama-site.xml) mounted at /opt/impala/resource-pools.
  #resourcePools:
  #  # Fair-scheduler queue tree and placement policy, rendered to fair-scheduler.xml.
  #  allocations:
  #    # Queue tree, rooted at a single queue.
  #    queues:
  #      - aclSubmitApps: ' '
  #        name: root
  #        queues:
  #        - aclSubmitApps: '*'
  #          maxResources:
  #            memory: 50000
  #            vcores: 0
  #          name: default
  #          type: leaf
  #        type: parent
  #
  #    # Rules that route an incoming query to a queue.
  #    queuePlacementPolicy:
  #      rules:
  #        - create: false
  #          name: specified
  #        - name: default
  #
  #  # Raw llama-site.xml properties, rendered verbatim in list order.
  #  llamaProperties:
  #    # List of name/value pairs written to llama-site.xml.
  #    properties:
  #      - name: llama.am.throttling.maximum.placed.reservations.root.default
  #        value: "10"

  ## TLS certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  tls: (7)
  #  ## Optional name of the Secret ADC creates from local files.
    secretName: tls-secret
  #  externalSecretName: existing-tls-secret
  #
  #  # Key in the Secret containing the TLS certificate.
    certificateKey: tls.crt
  #
  #  # Key in the Secret containing the TLS private key.
    privateKey: tls.key
  #
  #  ## Key in the Secret containing the client CA certificate.
  #  #clientCaCertificate: ca.crt
  #
  #  ## Local files 'adc apply' puts into the Secret named by tls.secretName.
  #  ## Relative paths are resolved against the config file.
    files:
      certificatePath: impala-jdbc.ru-central1.internal.crt
      privateKeyPath: impala-jdbc.ru-central1.internal.key
  #  #  #clientCaCertificatePath: /path/to/ca.crt

  ## TLS certificate configuration for web UI and HTTP endpoints.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  #webTLS:
  #  ## Optional name of the Secret ADC creates from local files.
  #  #secretName: custom-web-tls-secret
  #  externalSecretName: existing-web-tls-secret
  #
  #  # Key in the Secret containing the web TLS certificate.
  #  certificateKey: tls.crt
  #
  #  # Key in the Secret containing the web TLS private key.
  #  privateKey: tls.key
  #
  #  ## Local files 'adc apply' puts into the Secret named by webTLS.secretName.
  #  ## Relative paths are resolved against the config file.
  #  #files:
  #  #  certificatePath: /path/to/tls.crt
  #  #  privateKeyPath: /path/to/tls.key

  ## CA certificate configuration for Impala.
  ## Set externalSecretName, or let ADC create a Secret from files.
  #ca:
  #  ## Optional name of the Secret ADC creates from a local file.
  #  #secretName: custom-ca-secret
  #  externalSecretName: existing-ca-secret
  #
  #  # Key in the Secret containing the CA certificate.
  #  certificateKey: ca.crt
  #
  #  ## Local files 'adc apply' puts into the Secret named by ca.secretName.
  #  ## Relative paths are resolved against the config file.
  #  #files:
  #  #  certificatePath: /path/to/ca.pem

  ## Controls whether Secret/ConfigMap changes restart pods.
  ## Set enabled: false to update referenced Secrets without restarting
  ## the workload; pods keep running the previous configuration until
  ## the policy is re-enabled. Defaults to enabled.
  #configurationRollout:
  #  enabled: false

1	Пространство имен, используемое кластером Impala.
2	Настройки для загрузки образа кластера Impala.
3	Настройки Hadoop, взятые из ранее созданного файла hadoop_conf.yaml.
4	Настройки Kerberos.
5	Если параметр `keytab.create` имеет значение `true`, оператор Kerberos сгенерирует секрет с именем, указанным в параметре `keytab.secretName`; если параметр `keytab.secretName` не указан, имя секрета будет иметь формат `<metadata.name>-keytab`. Если параметр `keytab.create` имеет значение `false`, имеющийся секрет с именем `keytab.secretName` будет использован для получения keytab-файла.
6	Настройки SSL.
7	Настройки TLS.

Если вы используете Impala с Ranger, обновите настройки Ranger согласно инструкции.

Вы можете проверить конфигурацию перед ее применением, выполнив команду apply с флагом --dry-run:

$ ./adc apply -f impala-cluster.yaml --dry-run > impala-cluster-render.yaml

impala-cluster-render.yaml

---
apiVersion: v1
kind: Secret
metadata:
  name: impala-configs
  namespace: impala
stringData:
  core-site.xml: |-
    <configuration>
      <property>
        <name>dfs.client.failover.proxy.provider.adh</name>
        <value>org.apache.hadoop.hdfs.server.namenode.ha.ObserverReadProxyProvider</value>
      </property>
      <property>
        <name>dfs.client.read.shortcircuit</name>
        <value>false</value>
      </property>
      <property>
        <name>dfs.datanode.kerberos.principal</name>
        <value>hdfs-datanode/_HOST@AD.RANGER-TEST</value>
      </property>
      <property>
        <name>dfs.ha.namenodes.adh</name>
        <value>nn_tsn-adh-k8s-1,nn_tsn-adh-k8s-3</value>
      </property>
      <property>
        <name>dfs.journalnode.kerberos.principal</name>
        <value>hdfs-journalnode/_HOST@AD.RANGER-TEST</value>
      </property>
      <property>
        <name>dfs.namenode.kerberos.principal</name>
        <value>hdfs-namenode/_HOST@AD.RANGER-TEST</value>
      </property>
      <property>
        <name>dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-1</name>
        <value>tsn-adh-k8s-1.ru-central1.internal:8020</value>
      </property>
      <property>
        <name>dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-3</name>
        <value>tsn-adh-k8s-3.ru-central1.internal:8020</value>
      </property>
      <property>
        <name>dfs.nameservices</name>
        <value>adh</value>
      </property>
      <property>
        <name>fs.defaultFS</name>
        <value>hdfs://adh</value>
      </property>
      <property>
        <name>hadoop.security.authentication</name>
        <value>kerberos</value>
      </property>
      <property>
        <name>hadoop.ssl.enabled</name>
        <value>true</value>
      </property>
      <property>
        <name>ozone.om.address.adh.om_tsn-adh-k8s-1</name>
        <value>tsn-adh-k8s-1.ru-central1.internal:9862</value>
      </property>
      <property>
        <name>ozone.om.address.adh.om_tsn-adh-k8s-2</name>
        <value>tsn-adh-k8s-2.ru-central1.internal:9862</value>
      </property>
      <property>
        <name>ozone.om.address.adh.om_tsn-adh-k8s-3</name>
        <value>tsn-adh-k8s-3.ru-central1.internal:9862</value>
      </property>
      <property>
        <name>ozone.om.kerberos.principal</name>
        <value>om/_HOST@AD.RANGER-TEST</value>
      </property>
      <property>
        <name>ozone.om.nodes.adh</name>
        <value>om_tsn-adh-k8s-1,om_tsn-adh-k8s-2,om_tsn-adh-k8s-3</value>
      </property>
      <property>
        <name>ozone.om.service.ids</name>
        <value>adhom</value>
      </property>
    </configuration>
  hive-site.xml: |-
    <configuration>
      <property>
        <name>hive.metastore.kerberos.principal</name>
        <value>hive/_HOST@AD.RANGER-TEST</value>
      </property>
      <property>
        <name>hive.metastore.sasl.enabled</name>
        <value>true</value>
      </property>
      <property>
        <name>hive.metastore.uris</name>
        <value>thrift://tsn-adh-k8s-1.ru-central1.internal:9083</value>
      </property>
      <property>
        <name>metastore.truststore.password</name>
        <value>bigdata</value>
      </property>
      <property>
        <name>metastore.truststore.path</name>
        <value>/etc/ssl/truststore.jks</value>
      </property>
      <property>
        <name>metastore.use.SSL</name>
        <value>true</value>
      </property>
    </configuration>
type: Opaque
---
apiVersion: v1
data:
  truststore.jks: <encoded-truststore>
kind: Secret
metadata:
  name: ssl-secret
  namespace: impala
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
  namespace: impala
stringData:
  tls.crt: |
    <encoded-tls-certificate>
  tls.key: |+
    <encoded-tls-key>

type: Opaque
---
apiVersion: krb5.arenadata.io/v1alpha1
kind: Keytab
metadata:
  name: kerberos-secret
  namespace: impala
spec:
  items:
  - labelSelector:
      env: prod
    principals:
    - impala/impala-jdbc.ru-central1.internal
    - HTTP/impala-jdbc.ru-central1.internal
    - HTTP/impala-cloud.ru-central1.internal
    - impala/impala-cloud.ru-central1.internal
    - impala/impala-jdbc.ru-central1.internal
    realm: AD.RANGER-TEST
  rotation:
    checkInterval: 1h
    interval: 24h
---
apiVersion: impala.arenadata.io/v1alpha1
kind: Cluster
metadata:
  name: impala
  namespace: impala
spec:
  catalog:
    metadata: {}
    replicas: 1
    spec:
      image: hub.arenadata.io/adc-enterprise/impala:<tag>
      imagePullPolicy: Always
  coordinator:
    metadata: {}
    replicas: 1
    spec:
      image: hub.arenadata.io/adc-enterprise/impala:<tag>
      imagePullPolicy: Always
  executor:
    metadata: {}
    replicas: 1
    spec:
      image: hub.arenadata.io/adc-enterprise/impala:<tag>
      imagePullPolicy: Always
  hadoopConfigsSecretName: impala-configs
  kerberos:
    hostname: impala-jdbc.ru-central1.internal
    kerberosSecretName: kerberos-secret
    realm: AD.RANGER-TEST
    service: impala
  ssl:
    secretName: ssl-secret
    trustStoreKey: truststore.jks
  statestore:
    metadata: {}
    replicas: 1
    spec:
      image: hub.arenadata.io/adc-enterprise/impala:<tag>
      imagePullPolicy: Always
  tls:
    certificateKey: tls.crt
    privateKey: tls.key
    secretName: tls-secret
status: {}

Если манифест корректный, примените конфигурацию:
```
$ ./adc apply -f impala-cluster.yaml
```
Ожидаемый вывод содержит сообщение с подтверждением успеха:
```
time="20260518133858UTC" level="info" msg="cluster impala applied to namespace impala"
```
Удалите старые поды кластера, чтобы оператор Impala создал новые с обновленной конфигурацией:
```
$ kubectl delete pods -n <impala-cluster-ns> -l app.kubernetes.io/instance=impala-cluster
```

Проверьте работоспособность подов кластера Impala:

$ kubectl get pods -n impala

Ожидаемый вывод должен быть похож на следующий:

NAME                   READY   STATUS    RESTARTS   AGE
impala-catalog-0       1/1     Running   0          70m
impala-coordinator-0   1/1     Running   0          70m
impala-executor-0      1/1     Running   0          70m
impala-statestore-0    1/1     Running   0          70m

Шаг 3. Проверка JDBC-соединения

Подключитесь к кластеру Impala через JDBC, например, с помощью DBeaver. После активации Kerberos и SSL строка подключения JDBC имеет следующий вид:
```
jdbc:impala://impala-jdbc.ru-central1.internal:21050/default;AuthMech=1;KrbServiceName=<KrbServiceName>;KrbHostFQDN=<KrbHostFQDN>;SSL=1;SSLTrustStore=<SSLTrustStore>;SSLTrustStorePwd=<SSLTrustStorePwd>;httpPath=cliservice
```
где:
- <KrbServiceName> — сервисное имя Kerberos. Например, impala.
- <KrbHostFQDN> — имя хоста, указанное в параметре kerberos.hostname конфигурационного файла кластера Impala (impala-cluster.yaml). Например, impala-jdbc.ru-central1.internal.
- <SSLTrustStore> — путь к truststore-файлу с сертификатами для использования DBeaver.
- <SSLTrustStorePwd> — пароль для доступа к truststore-файлу.

Установив подключение, выполните тестовую команду для проверки работоспособности кластера:

SHOW DATABASES;

Ожидаемый вывод:

name            |comment                                     |
----------------+--------------------------------------------+
_impala_builtins|System database for Impala builtin functions|
default         |Default Hive database                       |

Удаление инстансов

Чтобы удалить оператор Kerberos, запустите следующую команду:

$ ./adc delete -f kerberos-operator.yaml

Нашли ошибку? Выделите текст и нажмите Ctrl+Enter чтобы сообщить о ней