Realtime Compute for Apache Flink:Register a Kerberized Hive cluster

Background

To allow a Flink job to access a Kerberized Hive data source, you must first register the cluster in the Realtime Compute for Apache Flink console. You can then configure this Kerberos information in the Flink job to enable access.

Limitations

• Kerberized Hive clusters that run on Hadoop 2.x and 3.x are supported.

  Note

  Support for Hadoop 2.x requires Ververica Runtime (VVR) 8.0.7 or later.

• You can register multiple Kerberized Hive clusters in a namespace.

• You can register multiple principals for each Kerberized Hive cluster.

• Each job can use only one principal from a Kerberized cluster.

• Kerberos authentication is not supported for session clusters. You cannot run queries or perform other operations on a Kerberized Hive cluster from a session cluster.

Register a Kerberized cluster

1. Open the registration page for Kerberized Hive clusters:

   1. Log on to the Realtime Compute for Apache Flink console.

   2. In the list of workspaces, find the desired workspace and click Console in the Actions column.

   3. In the left-side navigation pane, select Security > Security.

2. On the Hive Kerberos tab, click Add Kerberos.

3. Configure the parameters.

   Parameter	Description
   Kerberos name	Enter a name for the Kerberized cluster.
   Kerberos krb5.conf	The krb5.conf file contains configuration settings for your Kerberos environment, including connection modes, security parameters, and the locations of Kerberos components. Click the icon to upload your krb5.conf file.
   principal	The name of the principal.
   Kerberos keytab	A keytab is a file containing principals and their encrypted keys, which allows a service to authenticate with Kerberos without a password. Click the icon to upload the keytab file for the principal.

   For information about how to obtain the configuration files, see Basic Kerberos operations.

4. Click OK.

   If you no longer need to use a Kerberized cluster, you can click Delete in the Actions column for the target cluster to unregister it. Deleting the registration will cause jobs in the namespace that use this Kerberos service to fail. Proceed with caution.

Add principals

You can add multiple principals to a registered Kerberized cluster.

1. Find the target Kerberized cluster and click Add in the Actions column.

2. In the Add Kerberos dialog box, add the principal and its corresponding keytab.

   You can click the plus (+) and minus (-) icons to add or remove principals. This feature is only available for Kerberized Hive clusters that use Hadoop 3.

3. Click the icon to view the added principal's information.

   The page displays the following fields for the added principal: Kerberos Name, principal, keytab (OSS path), and Recently modified by.

References

• Manage Hive catalogs

• Run Flink SQL jobs

• Create deployments