E-MapReduce:Access the web UIs of open source components

Background information

Method 1: Access the web UIs of open source components by using Knox

Add a security group rule

The first time you use a component, perform the following steps to configure security group rules:

1. Obtain the public IP address of your on-premises machine.
   For security purposes, we recommend that you allow access only from the current public IP address when you configure a security group rule. To obtain the current public IP address, visit https://myip.ipip.net/.
2. Go to the Basic Information tab of the desired cluster.
   1. Log on to the EMR on ECS console.
   2. In the top navigation bar, select the region where your cluster resides and select a resource group based on your business requirements.
   3. On the EMR on ECS page, find the desired cluster and click the name of the cluster in the Cluster ID/Name column.
3. Add a security group rule.
   1. In the Security section of the Basic Information tab, click the link to the right of Cluster Security Group.
   2. On the Security Group Rules tab, enable port 8443.
      Important To prevent attacks from external users, we recommend that you do not set the Authorization Object parameter to 0.0.0.0/0.

      1. On the Security Group Rules tab, click Add Rule.
      2. Set the Port Range parameter to 8443/8443 and the Authorization Object parameter to the public IP address that you obtained in Step 1.
      3. Click Save in the Actions column.

      Note

      • If the network type of the cluster is VPC, set the NIC Type parameter to Internal Network and the Rule Direction parameter to Inbound. If the network type of the cluster is classic network, set the NIC Type parameter to Internet and the Rule Direction parameter to Inbound. In this topic, the VPC network type is used.
      • When you configure inbound and outbound rules for applications, follow the principle of least privilege. We recommend that you enable only the ports that are required by your applications.
   3. View the added rule.

      After you complete the configurations, network access is enabled in a secure manner.

Access the web UIs of open source components

1. Go to the Access Links and Ports tab.
   1. Log on to the EMR on ECS console.
   2. In the top navigation bar, select the region where your cluster resides and select a resource group based on your business requirements.
   3. On the EMR on ECS page, find the desired cluster and click the name of the cluster in the Cluster ID/Name column.
   4. On the page that appears, click the Access Links and Ports tab.
2. On the Access Links and Ports tab, find the component whose web UI you want to access and click the link in the Knox Proxy Address column.
   Important If you do not assign a public IP address to the master node of the cluster, you can access the web UIs of open source components only by using the internal Knox proxy address. If you want to use the public Knox proxy address to access the web UIs of open source components, perform the following steps.

   1. On the Nodes tab, click the Plus icon to the left of the master node group. In the Node Name/ID column, click the ID of the master-1-1 node.
   2. In the Elastic Compute Service (ECS) console, associate an elastic IP address (EIP) with the ECS instance of the master-1-1 node. For more information, see Associate or disassociate an EIP.
   3. Synchronize host information.
      1. On the Nodes tab, choose All Operations > Synchronize Host Information in the upper-right corner.
      2. In the message that appears, click Off.

         On the Access Links and Ports tab, you can access the web UIs of open source components by using the public Knox proxy address.

3. Use an added user for logon authentication and access the web UI of the corresponding open source component.
   For information about how to add a user, see Manage user accounts.
4. Access the web UIs of some special open source components.
   • Access the web UI of Ranger
     After Ranger is deployed in a cluster, you can use the default username and password of Ranger to access the web UI of Ranger. For more information, see Overview.

     Note For Hadoop clusters, the default username and password of Ranger are admin. For DataLake clusters or custom clusters, the default username of Ranger is admin and the default password is admin1234.
   • Access the web UI of Flink (minor versions earlier than EMR V3.29.0)
     In minor versions earlier than EMR V3.29.0, you can access the web UI of Flink only by using an SSH tunnel. For more information, see Create an SSH tunnel to access web UIs of open source components.

     Note To access a Flink job on the web UI of YARN, go to the Access Links and Ports tab in the EMR console, and click the link of the YARN UI in the Knox Proxy Address column. In the Hadoop console, click the ID of the Flink job to view the details of the Flink job.

Method 2: Access the web UIs of open source components by using internal IP addresses

Add a security group rule

1. Obtain the internal IP address of your on-premises machine.
   For security purposes, we recommend that you allow access only from the current internal IP address when you configure a security group rule.
2. Go to the cluster information page.
   1. Log on to the EMR on ECS console.
   2. In the top navigation bar, select the region where your cluster resides and select a resource group based on your business requirements.
   3. On the EMR on ECS page, find the desired cluster and click the name of the cluster in the Cluster ID/Name column.
3. Add a security group rule.
   1. In the Security section of the Basic Information tab, click the link to the right of Cluster Security Group.
   2. On the Security Group Rules tab, enable the required ports.
      Important To prevent attacks from external users, we recommend that you do not set the Authorization Object parameter to 0.0.0.0/0.

      The ports that are required vary based on the open source components whose web UIs you want to access. You can view the port of a service from its native UI address. The port number follows the IP address in the native UI address. The following steps describe how to enable the port for HDFS. The native UI address of HDFS is https://{Internal IP address of the host}:8088. Therefore, the port 8088 needs to be enabled for the security group.

      1. On the Security Group Rules tab, click Add Rule.
      2. Set the Port Range parameter to 8088/8088 and the Authorization Object parameter to the internal IP address that you obtained in Step 1.
      3. Click Save in the Actions column.

      Note

      • If the network type of the cluster is VPC, set the NIC Type parameter to Internal Network and the Rule Direction parameter to Inbound. If the network type of the cluster is classic network, set the NIC Type parameter to Internet and the Rule Direction parameter to Inbound. In this topic, the VPC network type is used.
      • When you configure inbound and outbound rules for applications, follow the principle of least privilege. We recommend that you enable only the ports that are required by your applications.
   3. View the added rule.

Access the web UIs of open source components

1. Go to the Access Links and Ports tab.
   1. Log on to the EMR on ECS console.
   2. In the top navigation bar, select the region where your cluster resides and select a resource group based on your business requirements.
   3. On the EMR on ECS page, find the desired cluster and click the name of the cluster in the Cluster ID/Name column.
   4. On the page that appears, click the Access Links and Ports tab.
2. On the Access Links and Ports tab, find the open source component whose web UI you want to access and click the link in the Native UI Address column.

FAQ

• Q: Why does the system have no response after I click the URL of an open source component?

  A: If you use Knox to access the web UI of an open source component, you must enable port 8443 for the security group of the desired cluster. If you use the native UI address of an open source component to access the web UI of the component, you must enable the required port for the security group of the desired cluster. For more information about how to add a security group rule, see Add a security group rule.

• Q: What are the username and password for logon authentication?

  A: Use an added user and the password that you specified for the user for logon authentication. For information about how to add a user, see Manage user accounts.