hadoopch
commented
10 months ago Hello,
it is correct to set tls to false if you want to use autotls.
But there are some issues.
For autotls you need to create a user with appropriate sudo rights and a password. Furthermore you have to define the following vars :
- host_ssh_username: "{{cdpcfg.install_user}}"
- host_ssh_password: "{{sec_cdpcfg['install_user']}}"
The request.j2 Template does not contain variables for private key resp. passphrase of the private key.
So you have to work with password or adjust the template
Furthermore you have to set:
- become: true
Otherwise the cloudera manager server does not restart.
Additionally the order in cluster.yml playbook is not good for autotls.
The autotls role includes a restart of CMS.
If you run autotls at a early stage of the playbook then CMS is still missing and the play will fail
Finally after the implementation of autotls a restart is required and client configuration has to be redeployed
To get it running (quick and dirty) i put the following lines into my application.yml
- name: Enable Auto-TLS
hosts: cloudera_manager
gather_facts: no
become: true
roles:
- cloudera.cluster.cloudera_manager.autotls
tags:
- ATLS
- never
- name: Restart and re-deploy stale client configs. After enabling autotls
hosts: localhost
gather_facts: no
roles:
- role: cloudera.cluster.operations.restart_stale
tags:
- ATLS
- never
- RESTARTAfter the Cluster is complete and i am able to connect to CM via HTTP i run the playbook again with:
--tags ATLS
and autols will be configured and services restarted
Hope this helps
Regards
Uli
Unable to restart service cloudera-scm-server when deploying cluster with autotls
Hello, when I am deploying cluster without
security: tlsindefinition.ymlin both mgmt and basic cluster sections. and withouttls=Truein the inventory file. like it is mentioned in this documentation. Without these and playbook tagautotls, cluster is deployed successfully, after that, manual autotls enablement is functional with both root and nonroot userI have tried all mentioned above, with setting autotls user in this file
But I am always getting this error.
Also checked logs from
/var/log/cloudera-scm-server/cloudera-scm-server.logwhen logging in CM web UI, I am able to see
Add Private Cloud Base Clustersort of wizard, with:AutoTLS has already been enabled.A KDC is currently not configured. This means you cannot create Kerberized clusters.in
/cmf/homethere is no cluster added.when running the same configuration, but using both
autotls,tlstags, playbook fails with different error:cloudera-scm-server status
some interesting logs from /var/cloudera-scm-server/cloudera-scm-server.log
I have also tried putting whole private key file content into variable
host_ssh_private_keycreated inhttps://github.com/cloudera-labs/cloudera.cluster/blob/main/roles/cloudera_manager/autotls/defaults/main.yml
and used this variable in this file
https://github.com/cloudera-labs/cloudera.cluster/blob/main/roles/cloudera_manager/autotls/templates/request.j2
Private key content had to be as one-line with
\\ninstead of newlines.when running with tags
default_cluster,kerberos,autotls,tls, withtls=trueininventory_static.iniandtls: truein security section of cluster/mgmt cluster definitions. got the following error:logs:
Caused by: java.io.IOException: unrecognised object: OPENSSH PRIVATE KEYindicates that CM somehow still cannot read the private key.