Docker kerberos

This image is designed to support the Hadoop clusters launched by Cloudbreak. The default realm is NODE.DC1.CONSUL and the default admin principal is admin/admin. All the default values can be modified with environment variables.

Usage

The image can be started in bootstrap mode and non-bootstrap mode. Bootstrap mode means when the container is launched it will create the DB for kerberos along with the admin user and start the KDC. This use-case is convenient for a quick start. The non-bootstrap mode relies on that a third party will do the necessary steps to create the appropriate principals thus the KDC will start only once they are created. Cloudbreak does this with a consul plugn.

Quick start

docker run -d --net=host -v /etc/krb5.conf:/etc/krb5.conf -v /dev/urandom:/dev/random --name kerberos -e BOOTSTRAP=0 sequenceiq/kerberos

The containers have a pretty bad entropy level so the KDC won't start because of this. We can overcome this by using /dev/urandom which is less secure but does not care about entropy. The /etc/krb5.conf is shared with the host so the generated configuration will be present on the host as well. We need to share this configuration with the ambari-server container as well or you need to take care of the copying. Once the container is running you can enable kerberos with Ambari.

Useful environment variables:

Environmenr variables	Description
REALM	the Kerberos realm
DOMAIN_REALM	the DNS domain for the realm
KERB_MASTER_KEY	master key for the KDC
KERB_ADMIN_USER	administrator account name
KERB_ADMIN_PASS	administrator's password
SEARCH_DOMAINS	domain suffix search list

Test

Once kerberos is enabled you need a ticket to execute any job on the cluster. Here's an example to get a ticket:

kinit -V -kt /etc/security/keytabs/smokeuser.headless.keytab ambari-qa-sparktest-rec@NODE.DC1.CONSUL

Example job:

export HADOOP_LIBS=/usr/hdp/current/hadoop-mapreduce-client
export JAR_EXAMPLES=$HADOOP_LIBS/hadoop-mapreduce-examples.jar
export JAR_JOBCLIENT=$HADOOP_LIBS/hadoop-mapreduce-client-jobclient.jar

hadoop jar $JAR_EXAMPLES teragen 10000000 /user/ambari-qa/terasort-input

hadoop jar $JAR_JOBCLIENT mrbench -baseDir /user/ambari-qa/smallJobsBenchmark -numRuns 5 -maps 10 -reduces 5 -inputLines 10 -inputType ascending