Friday, 29 March 2019

Ansible Cheat sheet





Install Ansible 


# yum install ansible


Host file configuration 


  • File 

[ansible@kuber2 ~]$ cat /etc/ansible/hosts
    [local]
    localhost
 
    [allhost]
    mfs091.tuxhub.com
    mfs092.tuxhub.com
    mfs093.tuxhub.com

Note:-

  • Host file we config by ansible.cfg


#inventory      = /etc/ansible/hosts


  • Command to  the list of hosts  
  • [ansible@kuber2 ~]$ ansible all  --list-hosts
      hosts (3):    mfs091.tuxhub.com    mfs092.tuxhub.com    mfs093.tuxhub.com[ansible@kuber2 ~]$ ansible all -i /tmp/hosts  --list-hosts  hosts (1):    mfs023.tuxhub.com
    [ansible@kuber2 ~]$ 

Help in ansible


[ansible@kuber2 ~]$ ansible-doc -l



[ansible@kuber2 ~]$ ansible-doc  atomic_host


Create a custom host file 

[ansible@kuber2 ~]$ cat /tmp/hosts
[customhosts]
mfs023.tuxhub.com

[ansible@kuber2 ~]$ 




[ansible@kuber2 ~]$ ansible all  -i /tmp/hosts -m ping 


mfs023.tuxhub.com | SUCCESS => {    "changed": false,     "ping": "pong"}





Override Ansible config :


  • Seqeunce of file ansible.cfg to be read 
  1.   Varibale in env :

[ansible@kuber2 ~]$ export ANSIBLE_CONFIG=/home/ansible/config/ansible.cfg



   2. Current dir from where anible command excuted
   3. home direcotry of user ( /home/user/.anisble.cfg)
   4. /etc/ansible/ansible.cfg



Ansible commandline :

Using Module 

1) ping 



[ansible@kuber2 ~]$ ansible all -m ping
mfs092.tuxhub.com | SUCCESS => {
"changed": false,
"ping": "pong"
}
mfs091.tuxhub.com | SUCCESS => {
"changed": false,
"ping": "pong"
}
mfs093.tuxhub.com | SUCCESS => {
"changed": false,
"ping": "pong"
}
localhost | SUCCESS => {
"changed": false,
"ping": "pong"
}


2) Shell    ( ansible <HOST> -m <module > -a <argument > 'COMMAND'


[ansible@kuber2 ~]$ ansible mfs091.tuxhub.com  -m shell -a  'yum list all | grep python'


Ansible System  Facts :


[ansible@kuber2 ~]$ ansible mfs091.tuxhub.com -m setup 



[ansible@kuber2 facts]$ ansible mfs091.tuxhub.com -m setup --tree /tmp/facts



[ansible@kuber2 facts]$ ansible mfs091.tuxhub.com -m  setup -a 'filter=*ipv*'




[ansible@kuber2 ~]$ ansible mfs091.tuxhub.com -m setup -a 'filter=ansible*'




Playbooks :


[ansible@kuber2 plyabook2]$ cat lynx.yml 
---
- hosts : all
  tasks :
        - name : Package Installtion
          yum : pkg=lynx state=installed update_cache=true


[ansible@kuber2 plyabook2]$


Playbook Varibales :


  1. Direct Vairables 

[ansible@kuber2 plyabook2]$ cat lynx.yml 
---
- hosts : all
  vars:
        cldbnodes : mfs091.tuxhub.com
  tasks :
        - name : Package Installtion on {{cldbnodes}}
          yum : pkg=lynx state=installed update_cache=true


[ansible@kuber2 plyabook2]$


Output


TASK [Package Installtion on mfs091.tuxhub.com] 



 2.  Varibale via files 


[ansible@kuber2 plyabook2]$ cat lynx.yml vars.yml 
---
- hosts : all
  vars_files:
   - vars.yml
  tasks :
        - name : Package Installtion on {{cldbnodes}}
          yum : pkg=lynx state=installed update_cache=true

Var.yml
---
cldbnodes: mfs091.tuxhub.com 


[ansible@kuber2 plyabook2]$ 


3. Run time varibale 

[ansible@kuber2 plyabook2]$ cat runtime.yml 
---

- hosts : all
  user : ansible      # run with ansible user  
  become : yes        # using sudo 
  connection :  ssh   # over ssh 
  gather_facts : no   # do not gather facts
  vars_files:
   - vars.yml
  vars_prompt : 
   - name : pkgtoinstall
     prompt : Install packges 

     private : no


Ansible Target Section :



[ansible@kuber2 plyabook2]$ cat target.yml 
---

- hosts : all
  user : ansible      # run with ansible user  
  become : yes        # using sudo 
  connection :  ssh   # over ssh 
  gather_facts : no   # do not gather facts

[ansible@kuber2 plyabook2]$ 


Ansible Task Section :

[ansible@kuber2 plyabook2]$ cat action.yml 
---

- hosts : all
  user : ansible      # run with ansible user  
  become : yes        # using sudo 
  connection :  ssh   # over ssh 
  gather_facts : no   # do not gather facts
  vars_files:
   - vars.yml
  tasks :
   - name  : Check the lynx install
     action : yum name=lynx state=installed 
        

[ansible@kuber2 plyabook2]$  


Ansible Notify Handler Section :

[ansible@kuber2 plyabook2]$ cat handler.yml
---

- hosts : all
  user : ansible      # run with ansible user  
  become : yes        # using sudo 
  connection :  ssh   # over ssh 
  gather_facts : no   # do not gather facts
  vars_files:
   - vars.yml
  tasks :
   - name  : Install and handler nginx 
     action : yum name=nginx state=installed
     notify : restart nginx
  handlers:
   - name : restart nginx
     action : service name=nginx state=restarted
        

[ansible@kuber2 plyabook2]$


Ansible Register Section :

[ansible@kuber2 outline]$ cat resister.yml 
--- # Outline to playbook translation 
- hosts : all 
  gather_facts : no
  become : true
  become_user: root
  tasks : 
   - name : date/time when playbok starts 
     command : /usr/bin/date
     register : timestamp_start

   - debug : var=timestamp_start


Ansible Dry run section Section :



[ansible@kuber2 plyabook2]$ ansible-playbook playbook.yml --check


Ansible Async polling Section :


[ansible@kuber2 plyabook2]$ grep fork /etc/ansible/ansible.cfg
#forks          = 5

[ansible@kuber2 plyabook2]


The default anisble run 5 nodes at a time but if we need more than 5 mode we need to use async method

[ansible@kuber2 plyabook2]$ cat lynx.yml 
---
- hosts : all
  become : true
  vars_files:
   - vars.yml
  tasks :
        - name : Package Installtion on {{cldbnodes}}
          yum : pkg=lynx state=installed update_cache=true
          async : 300  # wait for 300 second for sucess
          poll : 3     # poll output every 3 second


[ansible@kuber2 plyabook2]$ 


Ansible Varibale Subsitution Section :

[ansible@kuber2 plyabook2]$ cat lynx.yml 
---
- hosts : all
  become : true
  vars_files:
   - vars.yml
  tasks :

        - name : Package Installtion on {{cldbnodes}}



[ansible@kuber2 plyabook2]$ cat vars.yml 
---
cldbnodes: mfs091.tuxhub.com 


[ansible@kuber2 plyabook2]$


[ansible@kuber2 plyabook2]$ cat pkg_installtion.yml 
---
- hosts : all
  become : true
  vars_prompt :
   - name : Installpackege
     prompt : Install packege to be installed 
     private : no
  tasks :
   - name : install {{Installpackege}}
     action : yum name={{Installpackege}} state=installed
     

[ansible@kuber2 plyabook2]$


Ansible Lookup Section :

Loopup is Inbuild functions


[ansible@kuber2 plyabook2]$ cat loopkup.yml 
---
- hosts : all
  become : true
  gather_facts : no
  tasks : 
   - debug : 
      msg: "{{ lookup('env','HOME') }} is the value" 

[ansible@kuber2 plyabook2]$ 


Ansible runonce Section :

It runs only on one system even hosts is all


[ansible@kuber2 plyabook2]$ cat runonce.yml 
---
- hosts : all
  user : ansible 
  gather_facts : no
  become : true
  tasks :
   - name : Run at one time 
     command : /usr/bin/date
     register : result
   - debug : var=result
     run_once : true 

[ansible@kuber2 plyabook2]$ 


Ansible Local action Section : ( 127 .0.0.1) 


[ansible@kuber2 plyabook2]$ cat localaction.yml 
--- 
- hosts : 127.0.0.1 
  connection : local 
  tasks :
   - name : install telent
     action : yum name=telnet state=installed

[ansible@kuber2 plyabook2]$


Ansible Loop Section :


[ansible@kuber2 plyabook2]$ cat loop.yml 
---
- hosts : all
  become : true
  gather_facts : no
  tasks : 
   - name : install via loop 
     action : yum name={{item}} state=installed
     with_items:
      - lynx
      - nginx

[ansible@kuber2 plyabook2]$




Ansible Conditional  Section :




[ansible@kuber2 plyabook2]$ cat conditional.yml
---
- hosts : all
  become: true
  tasks:
   - name : install via ngnix conditional 
     action : yum name=ngnix state=installed
     when : ansible_os_family == "centos" 

[ansible@kuber2 plyabook2]$



Ansible Until Section :



[ansible@kuber2 plyabook2]$ cat until.yml 
--- 
- hosts : all
  become : true
  gather_facts : no 
  tasks :
   - name : test until 
     action : yum name=httpd state=installed 
   - name : verify status 
     shell : systemctl status httpd
     register : result
     until : result.stdout.find("Active (running )") != -1 
     retry : 5 
     delay : 5 
   - debug : var=result
     

[ansible@kuber2 plyabook2]$ 


Ansible valut ( passoword ) 


[ansible@kuber2 plyabook2]$ ansible-vault create secure.yml
New Vault password: 

Confirm New Vault password: 


[ansible@kuber2 plyabook2]$ cat secure.yml 
$ANSIBLE_VAULT;1.1;AES256
35383232613735396438633236613266623432346462333063393061626135396164343830336430
3733663435393065656139613839313832326634666636620a626130353037396631393539373539
66613631393362346538663530633637326439643333623362643766333665373763366531356230
3330333864616530620a613831346637366639663365326562343962646562663532313065366231
6131

[ansible@kuber2 plyabook2]$


[ansible@kuber2 plyabook2]$ ansible-vault view secure.yml
Vault password: 
test1=password

[ansible@kuber2 plyabook2]$ 



Ansible  Include



--- # full include task 
- hosts : webbox
  become : true
  connection : ssh
  gather_facts: no
  tasks :

    - include : plays/pkg.yml




[ansible@kuber2 playbooks]$ cat plays/pkg.yml 
--- # install telnet 

- name : install telent 
  yum : pkg=telnet state=installed
- name : install lynx
  yum :  pkg=lynx state=installed 

[ansible@kuber2 playbooks]$ 



Ansible  Tags 

Just to run verification

[ansible@kuber2 playbooks]$ cat tag.yml 
--- # Tag functionallty yml 
- hosts : webbox 
  become : true 
  gather_facts : no 
  connection: ssh 
  tasks : 
   - name : installe telent and lynx 
     yum : pkg={{item}} state=latest
     with_items : 
        - telnet
        - lynx
     tags : 
        - packages 
   - name : verify telent install
     command : yum list insalled | grep telent 
     tags : 
        - verification
[ansible@kuber2 playbooks]$ 



Execute only tags


[ansible@kuber2 playbooks]$ ansible-playbook tag.yml --tags "verification"

Skip the tags


[ansible@kuber2 playbooks]$ ansible-playbook tag.yml --skip-tags "packages"


Always run the verification ignore only if it skips.

[ansible@kuber2 plyabook2]$ cat tag.yml 
--- # Tag functionallty yml 
- hosts : all
  become : true 
  gather_facts : no 
  connection: ssh 
  tasks : 
   - name : installe telent and lynx 
     yum : pkg={{item}} state=latest
     with_items : 
        - telnet
        - lynx
     tags : 
        - packages 
   - name : verify telent install
     command : yum list insalled | grep telent 
     tags : 

        - always




Ansible  ERROR handle: 

If  ignore_Error : yes then even if first task fails it will continue 



[ansible@kuber2 plyabook2]$ cat errorhandle.yml 
---
- hosts : all
  become : true 
  gather_facts : no 
  tasks : 
   - name : fail command 
     command : /bin/false
     ignore_errors : yes
   - name : Install telent 
     action : yum name=telnet state=installed
   

[ansible@kuber2 plyabook2]$


Ansible  startat / step  :

It will ask to perform or not :


[root@kuber2 plyabook2]# cat startat.yml 
--- # startat example playbook 
- hosts : all
  become : true 
  gather_facts : no 
  connection : ssh
  tasks : 
    - name : install telnet 
      yum : pkg=telnet state=latest 
    - name : install lynx 
      yum : pkg=lynx state=latest 
    - name : list dir 
      shell : ls -l /var

[root@kuber2 plyabook2]# 

Ansible command line  :



[root@kuber2 plyabook2]# cat fromcmdline.yml 
---
- hosts : '{{hosts}}'
  user : '{{user}}'
  become : true
  gather_facts : no
  tasks : 
   - name : Install telent client 
     action : yum  name={{pkg}} state=latest
      

[root@kuber2 plyabook2]# 



[root@kuber2 plyabook2]# ansible-playbook fromcmdline.yml  --extra-vars "hosts=all user=ansible pkg=telnet"




Monday, 15 October 2018

Docker Monitoring Cadvisor/Prometheus/Grafana


Run Cadvisor docker images to pull metrics

[root@kuber1 ~]#  docker run  --volume=/:/rootfs:ro  --volume=/var/run:/var/run:rw  --volume=/sys:/sys:ro  --volume=/var/lib/docker/:/var/lib/docker:ro  --volume=/dev/disk/:/dev/disk:ro  --publish=8080:8080  --detach=true  --name=cadvisor  google/cadvisor:latest

Cadvisor  WebUI 

http://kuber1.tuxhub.com:8080/containers/


Prometheus Configurations : 

[root@kuber1 ~]# vim /usr/local/prometheus/prometheus-2.4.3/prometheus.yml 

- job_name: 'docker'
   static_configs:
    - targets:
      - 10.10.72.108:8080    # 10.10.72.108 is kuber1.tuxhub.com 

Start Prometheus : 

[root@kuber1 ~]#  /usr/local/prometheus/prometheus-2.4.3//prometheus --web.listen-address=10.10.72.108:9080


Build Grafana Dashboard 

Download dashboard from 

https://gist.githubusercontent.com/njadhav1/37728ddc759ca188a2758c62721f43a0/raw/79d0e80a7e7b7185edf85533a




Friday, 12 October 2018

Kafka Installation & Monitoring

Kakfa Installtion

Host Details : -

10.10.72.108 kuber1.tuxhub.com kuber1
10.10.72.109 kuber2.tuxhub.com kuber2
10.10.72.114 kuber4.tuxhub.com kuber4


 Host :- kuber1.tuxhub.com

[root@kuber1 ]#  mkdir /usr/local/kafka;cd /usr/local/kafka;wget http://apache.mirror.digitalpacific.com.au/kafka/0.10.2.1/kafka_2.12-0.10.2.1.tgz;tar -zxf kafka_2.12-0.10.2.1.tgz ;mv kafka_2.12-0.10.2.1 kafka-2.12

[root@kuber1 config]#
[root@kuber1 config]# vim server.properties
broker.id=1                               # Need to change this on every node
delete.topic.enable=true
advertised.listeners=PLAINTEXT://kuber1.tuxhub.com:9092    # Need to change this on every node
num.network.threads=3
num.io.threads=8
default.replication.factor=3
min.insync.replicas=2
socket.send.buffer.bytes=102400
socket.receive.buffer.bytes=102400
socket.request.max.bytes=104857600
log.dirs=/data/kafka
num.partitions=8
num.recovery.threads.per.data.dir=1
log.retention.hours=168
log.segment.bytes=1073741824
log.retention.check.interval.ms=300000
zookeeper.connect=10.10.72.109:5181/kafka     # Zookeeper host
zookeeper.connection.timeout.ms=6000
auto.create.topic.enable=true


On All nodes

Make sure to chnage "java.rmi.server.hostname"

[root@kuber1 ]# vim /usr/local/kafka/kafka-2.12/bin/kafka-server-start.sh
export KAFKA_JMX_OPTS="-Dcom.sun.management.jmxremote=true -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=kuber1.tuxhub.com  -Djava.net.preferIPv4Stack=true"
export JMX_PORT=9999
export KAFKA_OPTS='-javaagent:/usr/local/prometheus/jmx-export/lib/jmx_prometheus_javaagent-0.3.1.jar=7071:/usr/local/prometheus/jmx-export/conf/kafka.yml'

For prometheus monitoring:

[mapr@kuber1 ~]$  wget https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/0.3.1/jmx_prometheus_javaagent-0.3.1.jar
[mapr@kuber1 ~]$ mkdir -p /usr/local/prometheus/jmx-export/{conf,lib}
[mapr@kuber1 ~]$  wget https://github.com/prometheus/prometheus/releases/download/v2.4.3/prometheus-2.4.3.linux-amd64.tar.gz
[mapr@kuber1 ~]$  cd /usr/local/prometheus/
[mapr@kuber1 ~]$  gunzip prometheus-2.4.3.linux-amd64.tar.gz
 [mapr@kuber1 ~]$  tar -xvf prometheus-2.4.3.linux-amd64.tar
 [mapr@kuber1 ~]$  mv  prometheus-2.4.3.linux-amd6/ prometheus-2.4.3

[mapr@kuber1 ~]$ cp -pav jmx_prometheus_javaagent-0.3.1.jar /usr/local/prometheus/jmx-export/lib/

[mapr@kuber1 ~]$ cd  /usr/local/prometheus/jmx-export/conf
[mapr@kuber1 ~]$ curl -O https://raw.githubusercontent.com/prometheus/jmx_exporter/master/example_configs/kafka-0-8-2.yml
[mapr@kuber1 ~]$ vim /usr/local/prometheus/prometheus-2.4.3/prometheus.yml

 Add config to prometheus.yml

 scrape_configs:
 - job_name: 'kafka'
   static_configs:
    - targets:
      - 10.10.72.108:7071
      - 10.10.72.109:7071
      - 10.10.72.114:7071

Start Kafka broker on all nodes

[mapr@kuber1 ~]$ /usr/local/kafka/kafka-2.12/bin/kafka-server-start.sh -daemon /usr/local/kafka/kafka-2.12/config/server.properties

Start Prometheus :

[mapr@kuber1 ~]$  /usr/local/prometheus/prometheus-2.4.3/prometheus --web.listen-address=10.10.72.108:9080

Start topic/producer/consumer :

A) Topic create
[mapr@kuber1 ~]$  /usr/local/kafka/kafka-2.12/bin/kafka-topics.sh --zookeeper kuber2.tuxhub.com:5181/kafka --partitions 3 --replication-factor 3  --create --topic t2

B) Producer launch

[mapr@kuber2 ~]$ /usr/local/kafka/kafka-2.12/bin/kafka-console-producer.sh --broker-list kuber1.tuxhub.com:9092,kuber2.tuxhub.com:9092,kuber4.tuxhub.com:9092 --topic t2

= > Send Msg1

C) Consumer Launch

[mapr@kuber4 ~]$ /usr/local/kafka/kafka-2.12/bin/kafka-console-consumer.sh --bootstrap-server  kuber1.tuxhub.com:9092,kuber2.tuxhub.com:9092,kuber4.tuxhub.com:9092 --topic t2  --from-beginning
= > Recive Msg1


Monitoring

A) prometheus

http://10.10.72.108:9080/

B) Grafana

Add a data source as prometheus

Import Kafka Dashboard

https://gist.githubusercontent.com/njadhav1/3f7fa2c7199f6952773d9a150eeebaf1/raw/473f45e916d8fc273fa6df70a38a6946f317ab4a/Kafka%2520Grafana%2520Dashboard

http://kuber1.tuxhub.com:3000/


C) Kafka Manager

Kafka Manager WebUI

[root@kuber1 docker]# cat kafka-manager.yml
version: '2'
services:
    kafka-manager:
        image: intropro/kafka-manager
        container_name: kafka-manager
        ports:
            - "9009:9000"
        environment:
            ZK_HOSTS: 10.10.72.109:5181


[root@kuber1 docker]# docker-compose -f kfka-manager.yml up -d

WebUI :

http://10.10.72.108:9009/clusters/

Dashboard :

http://kuber1.tuxhub.com:3000/


Wednesday, 3 October 2018

Kafka Manager WebUI

[root@kuber1 docker]# cat kafka-manager.yml 
version: '2'
services:
    kafka-manager:
        image: intropro/kafka-manager
        container_name: kafka-manager
        ports:
            - "9009:9000"
        environment:
            ZK_HOSTS: 10.10.72.109:5181

[root@kuber1 docker]#

[root@kuber1 docker]# docker-compose -f kafka-manager.yml up -d

WebUI : 

http://10.10.72.108:9009/clusters/Kafka/assignment


Tuesday, 25 September 2018

Zookeeper WebUI with Docker




[root@kuber1 docker]# cat zoonavi.yml 
version: '2.1'

services:
  web:
    image: elkozmon/zoonavigator-web:latest
    container_name: zoonavigator-web
    ports:
     - "8000:8000"
    environment:
      API_HOST: "api"
      API_PORT: 9000
    depends_on:
     - api
    restart: always
  api:
    image: elkozmon/zoonavigator-api:latest
    container_name: zoonavigator-api
    environment:
      SERVER_HTTP_PORT: 9000
    restart: always

[root@kuber1 docker]#

[root@kuber1 docker]# docker-compose -f zoonavi.yml  up -d

[root@kuber1 docker]# docker ps
CONTAINER ID        IMAGE                              COMMAND             CREATED             STATUS                   PORTS                            NAMES
3e89fd7f04df        elkozmon/zoonavigator-web:latest   "./run.sh"          6 minutes ago       Up 6 minutes (healthy)   80/tcp, 0.0.0.0:8000->8000/tcp   zoonavigator-web
466ce28f46dc        elkozmon/zoonavigator-api:latest   "./run.sh"          6 minutes ago       Up 6 minutes (healthy)   9000/tcp                         zoonavigator-api


From browser :

http://10.10.72.108:8000 


Friday, 21 October 2016

Hiveserver2 with Openldap on MapR




Step 1 ) Edit hive-site.xml

# vim /opt/mapr/hive/hive-1.2/conf/hive-site.xml

<!-- LDAP AUTHENTICATION -->

<property>
     <name>hive.server2.authentication</name>
     <value>LDAP</value>
</property>

<property>
     <name>hive.server2.authentication.ldap.url</name>
     <value>ldap://adp034</value>
</property>

<property>
     <name>hive.server2.authentication.ldap.baseDN</name>
     <value>ou=Users,dc=tuxhub,dc=com</value>
</property>
<property>
  <name>hive.server2.enable.doAs</name>
  <value>true</value>
</property>


<!-- HIVE IMPERSANATION -->

<property>
  <name>hive.server2.enable.doAs</name>
  <value>true</value>
</property>
<property>
  <name>hive.metastore.execute.setugi</name>
  <value>true</value>
</property>


2) Connect your OS to ldap

[root@satz-n01 ~]# authconfig-tui



3) Select "Use Ldap"

You may need to install  yum install nss-pam-ldapd if get any error while selecting Ldap


4) Execute id command to check user infomration is populated.

[root@satz-n01 ~]# id <LDAP USER>

5) Restart HS2  and Hivemeta store

# maprcli node services -name hivemeta -action restart -nodes `hostname`
# maprcli node services -name hs2 -action restart -nodes `hostname`

6) Connect via beeline

[mapr@satz-n01 ~]$ /opt/mapr/hive/hive-1.2/bin/beeline

0: jdbc:hive2://localhost:10000/default (closed)> !connect jdbc:hive2://localhost:10000/default
Connecting to jdbc:hive2://localhost:10000/default
Enter username for jdbc:hive2://localhost:10000/default: uhg2
Enter password for jdbc:hive2://localhost:10000/default: ****
Connected to: Apache Hive (version 1.2.0-mapr-1609)
Driver: Hive JDBC (version 1.2.0-mapr-1609)
Transaction isolation: TRANSACTION_REPEATABLE_READ

Tuesday, 20 September 2016

Hiveserver2 With Kerberos



 Step 1 ) Add hive-site.xml 
 
<property>
  <name>hive.server2.authentication</name>
  <value>KERBEROS</value>
</property>
<property>
  <name>hive.server2.authentication.kerberos.principal</name>
  <value>hive/_HOST@YOUR-REALM.COM</value>
</property>
<property>
  <name>hive.server2.authentication.kerberos.keytab</name>
  <value>/etc/hive/conf/hive.keytab</value>
</property>
<property>
  <name>hive.server2.enable.doAs</name>
  <value>false</value>
</property>

Step 2 ) Add principal:

# kadmin.local

kadmin.local: add_principal -randkey hive/cdh084.tuxhub.com@TUXHUB.COM
kadmin.local: change_password hive/cdh084.tuxhub.com@TUXHUB.COM
kadmin.local: xst -k /etc/hive/conf/hive.keytab hive/cdh084.tuxhub.com@TUXHUB.COM

Step 3 ) Check permission :-

[root@cdh084 ~]# ll /etc/hive/conf/hive.keytab
-rw------- 1 hive hive 442 Sep 20 18:49 /etc/hive/conf/hive.keytab
[root@cdh084 ~]#
Step 3 )  Restart hiveserver2

[root@cdh084 ~]# /etc/init.d/hive-server2 restart

Step 4 ) Connect to beeline

beeline> !connect jdbc:hive2://localhost:10000/default;principal=hive/cdh084.tuxhub.com@TUXHUB.COM
nter username for jdbc:hive2://localhost:10000/default;principal=hive/cdh084.tuxhub.com@TUXHUB.COM: <ENTER ANYTHING>
Enter password for jdbc:hive2://localhost:10000/default;principal=hive/cdh084.tuxhub.com@TUXHUB.COM: <ENTER ANYTHING>
Connected to: Apache Hive (version 1.1.0-cdh5.8.0)
Driver: Hive JDBC (version 1.1.0-cdh5.8.0)
Transaction isolation: TRANSACTION_REPEATABLE_READ
0: jdbc:hive2://localhost:10000/default>

Thursday, 25 August 2016

Ganglia Installtion


You must have epel repo installed

1) Installtion :

 On all nodes

# yum search ganglia-gmond


On one node

# sudo yum install ganglia-gmetad
# yum install ganglia-web.x86_64

2) Config

# /etc/ganglia/gmond.conf

# Gmond.conf

cluster {
  name = "tuxhub"

}

udp_send_channel {
  host = "gemtad.tuxhub.com"
  port = 8649
  ttl = 1
}

/* You can specify as many udp_recv_channels as you like as well. */
udp_recv_channel {
  port = 8649
}

/* You can specify as many tcp_accept_channels as you like to share
   an xml description of the state of the cluster */
tcp_accept_channel {
  port = 8649
}


# /etc/ganglia/gmetad.conf

data_source "tuxhub" gemtad.tuxhub.com

3) Services

Start services

On all nodes
service gmond start

On gmeta node.

service gmetad start
service httpd  start


Sunday, 14 August 2016

Kerberos Installtion And Configuration To Access Hadoop ( CDH 5.X)



Install Kerberos :

1) On client nodes

# yum install krb5-libs krb5-auth-dialog krb5-workstation

On server node

# yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation

2) On all nodes edit krb5.conf

[root@cdh084 krb5kdc]# cat /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = TUXHUB.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 TUXHUB.COM = {
  kdc = cdh084.tuxhub.com
  admin_server = cdh084.tuxhub.com
 }

[domain_realm]
 .tuxhub.com = TUXHUB.COM
 tuxhub.com = TUXHUB.COM
[root@cdh084 krb5kdc]#

3) Edit kerberos acl

[root@cdh084 krb5kdc]# cat  /var/kerberos/krb5kdc/kadm5.acl
*/admin@TUXHUB.COM      *
[root@cdh084 krb5kdc]#

4) kerberos database config

[root@cdh084 krb5kdc]# cat  /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 TUXHUB.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }
[root@cdh084 krb5kdc]#

5) Create database

[root@cdh084 ~]# kdb5_util create -r TUXHUB.COM -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'TUXHUB.COM',
master key name 'K/M@TUXHUB.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: master
Re-enter KDC database master key to verify: master

[root@cdh084 ~]#

6) Create admin principal  create the first user principal. This must be done on the KDC server itself, while you are logged in as root:

[root@cdh084 ~]# kadmin.local
Authenticating as principal root/admin@TUXHUB.COM with password.
kadmin.local:  addprinc root/admin
WARNING: no policy specified for root/admin@TUXHUB.COM; defaulting to no policy
Enter password for principal "root/admin@TUXHUB.COM": admin
Re-enter password for principal "root/admin@TUXHUB.COM": admin
Principal "root/admin@TUXHUB.COM" created.

7) Start services

[root@cdh084 krb5kdc]# service kadmin start
Starting Kerberos 5 Admin Server:                          [  OK  ]
[root@cdh084 krb5kdc]# service krb5kdc start
Starting Kerberos 5 KDC:                                   [  OK  ]

8) Creating Service Principals for every host ( chnage host name)

[root@cdh084  ]# kadmin
kadmin:  add_principal -randkey hdfs/cdh084.tuxhub.com@TUXHUB.COM
kadmin:  add_principal -randkey mapred/cdh084.tuxhub.com@TUXHUB.COM
kadmin:  add_principal -randkey HTTP/cdh084.tuxhub.com@TUXHUB.COM
kadmin:  add_principal -randkey yarn/cdh084.tuxhub.com@TUXHUB.COM

9) Create Keytab files add everyhost principal
[root@cdh084  ]# kadmin
kadmin:  xst -k /tmp/hdfs.keytab hdfs/cdh085.tuxhub.com@TUXHUB.COM HTTP/cdh085.tuxhub.com@TUXHUB.COM ( ADD ALL HOST )
kadmin:  xst -k /tmp/mapred.keytab mapred/cdh085.tuxhub.com@TUXHUB.COM HTTP/cdh085.tuxhub.com@TUXHUB.COM ( ADD ALL HOST )
kadmin:  xst -k /tmp/yarn.keytab yarn/cdh085.tuxhub.com@TUXHUB.COM HTTP/cdh085.tuxhub.com@TUXHUB.COM  ( ADD ALL HOST )


10) Permission
[root@cdh084 keytab]# cp -pav /tmp/*.keytab /etc/hadoop/conf
[root@cdh084 keytab]# chown hdfs:hadoop /etc/hadoop/conf/hdfs.keytab
[root@cdh084 keytab]# chown mapred:hadoop /etc/hadoop/conf/mapred.keytab
[root@cdh084 keytab]# chown yarn:hadoop /etc/hadoop/conf/yarn.keytab
[root@cdh084 keytab]# chmod 400 /etc/hadoop/conf/hdfs.keytab /etc/hadoop/conf/mapred.keytab /etc/hadoop/conf/yarn.keytab
[root@cdh084 keytab]#

11) EDIT core-site.xml

<configuration>

<property>
 <name>fs.defaultFS</name>
 <value>hdfs://cdh081.tuxhub.com:8020</value>
</property>


<property>
 <name>hadoop.proxyuser.mapred.groups</name>
 <value>*</value>
</property>

<property>
 <name>hadoop.proxyuser.mapred.hosts</name>
 <value>*</value>
</property>

<property>
<name>hadoop.proxyuser.httpfs.hosts</name>
<value>*</value>
</property>
<property>
<name>hadoop.proxyuser.httpfs.groups</name>
<value>*</value>
</property>

<property>
  <name>hadoop.security.authentication</name>
    <value>kerberos</value>
</property>

<property>
  <name>hadoop.security.authorization</name>
    <value>true</value>
</property>


</configuration>
[root@cdh081 ~]#

12) hdfs.site.xml

<configuration>
  <property>
     <name>dfs.namenode.name.dir</name>
     <value>file:///var/lib/hadoop-hdfs/cache/hdfs/dfs/name</value>
  </property>

  <property>
     <name>dfs.permissions.superusergroup</name>
     <value>hadoop</value>
  </property>


  <property>
     <name>dfs.datanode.data.dir</name>
     <value>file:///home/data/1/dfs/dn</value>
  </property>

 <property>
   <name>dfs.webhdfs.enabled</name>
    <value>true</value>
 </property>


<!-- SECURITY -->

<!-- General HDFS security config -->
<property>
  <name>dfs.block.access.token.enable</name>
  <value>true</value>
</property>

<!-- NameNode security config -->
<property>
  <name>dfs.namenode.keytab.file</name>
  <value>/etc/hadoop/conf/hdfs.keytab</value> <!-- path to the HDFS keytab -->
</property>
<property>
  <name>dfs.namenode.kerberos.principal</name>
  <value>hdfs/_HOST@TUXHUB.COM</value>
</property>
<property>
  <name>dfs.namenode.kerberos.internal.spnego.principal</name>
  <value>HTTP/_HOST@TUXHUB.COM</value>
</property>

<!-- DataNode security config -->
<property>
  <name>dfs.datanode.data.dir.perm</name>
  <value>700</value>
</property>
<property>
  <name>dfs.datanode.address</name>
  <value>cdh081.tuxhub.com:1004</value>
</property>
<property>
  <name>dfs.datanode.http.address</name>
  <value>cdh081.tuxhub.com:1006</value>
</property>
<property>
  <name>dfs.datanode.keytab.file</name>
  <value>/etc/hadoop/conf/hdfs.keytab</value> <!-- path to the HDFS keytab -->
</property>
<property>
  <name>dfs.datanode.kerberos.principal</name>
  <value>hdfs/_HOST@TUXHUB.COM</value>
</property>

<!-- Web Authentication config -->
<property>
  <name>dfs.web.authentication.kerberos.principal</name>
  <value>HTTP/_HOST@TUXHUB.COM</value>
 </property>

<property>
<name>dfs.http.policy</name>
<value>HTTPS_ONLY</value>
</property>

</configuration>

13) SECURE Datanodes

vim /etc/default/hadoop-hdfs-datanode

export HADOOP_SECURE_DN_USER=hdfs
export HADOOP_SECURE_DN_PID_DIR=/var/lib/hadoop-hdfs
export HADOOP_SECURE_DN_LOG_DIR=/var/log/hadoop-hdfs
export JSVC_HOME=/usr/lib/bigtop-utils/

14) SSL

 keytool -genkey -alias replserver -keyalg RSA -keystore keystore.jks -dname "cn=localhost, ou=IT, o=Continuent, c=US"  -storepass password -keypass password
 keytool -export -alias replserver -file client.cer -keystore keystore.jks
 keytool -import -v -trustcacerts -alias replserver -file client.cer -keystore truststore.ts

 Copy SSL files

 cp -pav keystore.jks truststore.ts /etc/hadoop/conf/

15) Hadoop SSL config

vim /etc/hadoop/conf/ssl-server.xml

<configuration>

<property>
  <name>ssl.server.truststore.location</name>
  <value>/etc/hadoop/conf/truststore.ts</value>
</property>

<property>
  <name>ssl.server.truststore.password</name>
  <value>keystore</value>
</property>

<property>
  <name>ssl.server.truststore.type</name>
  <value>jks</value>
</property>

<property>
  <name>ssl.server.truststore.reload.interval</name>
  <value>10000</value>
  Default value is 10000 (10 seconds).
</property>

<property>
  <name>ssl.server.keystore.location</name>
  <value>/etc/hadoop/conf/keystore.jks</value>
</property>

<property>
  <name>ssl.server.keystore.password</name>
  <value>keystore</value>
</property>

<property>
  <name>ssl.server.keystore.keypassword</name>
  <value>keystore</value>
</property>

<property>
  <name>ssl.server.keystore.type</name>
  <value>jks</value>
</property>

<property>
  <name>ssl.server.exclude.cipher.list</name>
  <value>TLS_ECDHE_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
  SSL_RSA_WITH_DES_CBC_SHA,SSL_DHE_RSA_WITH_DES_CBC_SHA,
  SSL_RSA_EXPORT_WITH_RC4_40_MD5,SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,
  SSL_RSA_WITH_RC4_128_MD5</value>
</property>

</configuration>

# /etc/hadoop/conf/ssl-client.xml

<configuration>

<property>
  <name>ssl.client.truststore.location</name>
  <value>/etc/hadoop/conf/truststore.ts</value>
  specified.
</property>

<property>
  <name>ssl.client.truststore.password</name>
  <value>keystore</value>
</property>

<property>
  <name>ssl.client.truststore.type</name>
  <value>jks</value>
</property>

<property>
  <name>ssl.client.truststore.reload.interval</name>
  <value>10000</value>
  Default value is 10000 (10 seconds).
</property>

<property>
  <name>ssl.client.keystore.location</name>
  <value>/etc/hadoop/conf/keystore.jks</value>
  specified.
</property>

<property>
  <name>ssl.client.keystore.password</name>
  <value>keystore</value>
</property>

<property>
  <name>ssl.client.keystore.keypassword</name>
  <value>keystore</value>
</property>

<property>
  <name>ssl.client.keystore.type</name>
  <value>jks</value>
</property>

</configuration>

16 ) NameNode start

# services hadoop-hdfs-namenode restart

17) Datanode start

#  services hadoop-hdfs-datanode restart

18) any one node

kinit -kt /etc/hadoop/conf/hdfs.keytab hdfs/cdh084.tuxhub.com@TUXHUB.COM

14) Klist

-bash-4.1$ klist
Ticket cache: FILE:/tmp/krb5cc_496
Default principal: hdfs/cdh084.tuxhub.com@TUXHUB.COM

Valid starting     Expires            Service principal
08/14/16 21:05:43  08/15/16 21:05:43  krbtgt/TUXHUB.COM@TUXHUB.COM
        renew until 08/14/16 21:05:43
-bash-4.1$

16)  Hadoop command

-bash-4.1$ hadoop fs -ls /

17) Please yarn-site.xml  to use kerberos.

Note :- All files present on
https://drive.google.com/file/d/0BxAxRcNkM4a0aWZxdGdOMWRtNDQ/view?usp=sharing

Ansible Cheat sheet

Install Ansible  # yum install ansible Host file configuration  File  [ansible@kuber2 ~]$ cat /etc/ansible/hosts     [loca...