Isilon hdfs proxy users

This may help clarify the use of Isilon proxy users on a kerberized Isilon. You need to create a proxy user for the service and then add users or groups that need to run jobs to that proxy user. Lets take a hive job as an example.   A Kerberos user: hdpuser3 tries to run […]

Read more "Isilon hdfs proxy users"

Tweaks to HDFS services to make them play nice with Kerberized Isilon access

If you are kerberizing a hadoop cluster against an Isilon, you’ll need to look at adding the following to the hdfs services to enable Isilon compatibility. All Distro’s 1. Add custom property hadoop.security.token.service.use_ip=false to core-site.xml When you kerberize with AD, Isilon’s cluster SPN is used and not the SCZ SPN.  (this is our odd behavior) […]

Read more "Tweaks to HDFS services to make them play nice with Kerberized Isilon access"

Increase the kerberos logging level on a client to see what is actually going on

if you are seeing issues with kerberos based hdfs client access against an Isilon cluster, increasing the kerberos logging level on the client can show you a lot more information(a lot) Change the logging level with the following: export HADOOP_ROOT_LOGGER=”TRACE,console” export HADOOP_OPTS=”-Dsun.security.krb5.debug=true”     quick example of a successful kerberized hadoop call from a kerberized […]

Read more "Increase the kerberos logging level on a client to see what is actually going on"

Isilon and Kerberos

I’m starting to see an increase in the amount of Kerberized access to Isilon clusters, the following is an excellent start to understanding the process of Kerberizing an Isilon cluster for NFS access. In later posts I’ll discuss Kerberized Hadoop access to Isilon.   But, this doc is a great first step, it’s hosted on […]

Read more "Isilon and Kerberos"