Describes the syntax and parameters of the configure.sh script that
you run for a number of tasks including setting up data-fabric client nodes, and configuring services for a
node.
You run configure.sh to set up a data-fabric cluster node, or to set up a data-fabric client node for communication with one or more clusters. You
can also run configure.sh to update the configuration of a node. For
example, you can use configure.sh to change the services running on a node, or specify the user that runs data-fabric services.
configure.sh script is named
configure.bat. The script requires the -c parameter and
does not accept the -Z parameter, but otherwise works similarly as on a
Linux client. configure.sh performs the following steps, each time you run it:/opt/mapr/conf/mapr-clusters.conf containing a cluster
name followed by a list of CLDB nodes. New entries are added to
mapr-clusters.conf when the cluster name passed to the
-N parameter is different from the existing cluster name in that
file.mapr-nfs role,
the script disables the standard Linux NFS daemon, since both NFS processes cannot run on
the same node.yarn-site.xml,
warden.conf, and cldb.conf may be updated based on
input to configure.sh./etc/shadow file enables data-fabric users to authenticate with the data-fabric cluster. configure.sh.-L parameter to
specify a different log file name.When you include disk-setup options (-D or -F) on
nodes with the mapr-fileserver role, the script performs the following
additional steps:
configure.sh takes the values that you specify in the
-disk-opts option, and passes the value to disksetup. For example, if
you include -disk-opts FW5 when you run configure.sh,
configure.sh runs disksteup -F -W5. If disksetup
fails, configure.sh exits with an error.
Starts Zookeeper and Warden. When the configure.sh script starts
services, the message starting <servicename> is echoed to the
standard output to enable the user to see which services are starting. When Warden
starts, the Warden and ZooKeeper services are added to the inittab file
as the first available inittab IDs, enabling these services to restart
automatically on failure.
You can specify the -no-autostart option to prevent the script from
starting Zookeeper or Warden when you run configure.sh with the
-F or -D options.
/opt/mapr/server/configure.sh
-C <cldb_list>
-Z <zookeeper_list>
-EZ <ext_zookeeper_list>
[<parameters>]/opt/mapr/server/configure.sh
-C <cldb_list>
[ -M <cldb_mh_list ...> ]
-Z <zookeeper_list>
[<parameters>]/opt/mapr/server/configure.sh
-c
[ -R ]
[<parameters>]/opt/mapr/server/configure.sh
-R
[ -c ]
[<parameters>]-C-C option for CLDB servers that only have a single IP
address. This option takes a comma-separated list of the CLDB nodes that this machine
uses to connect to the data-fabric cluster. The list is in the following format:
hostname[:port_no][,hostname[:port_no]...]-c-C option is required, while the
-Z option is optional. See set up a
data-fabric client node for
communication with one or more clusters.-EZ-EZ option is optional when configuring the cluster, and is not
applicable when configuring a client. This option takes a comma-separated list of the
external IP addresses of the ZooKeeper nodes in the cluster. The list is in the
following format:
hostname[:port_no][,hostname[:port_no] ...]-M-M option only for multihomed CLDB servers that have more
than one IP address. This option takes a comma-separated list of the multihomed CLDB
nodes that this machine uses to connect to the data-fabric cluster. The list is in the following format:
hostname[:port_no][,[hostname[:port_no]...]] -Rconfigure.sh
should use the previously configured ZooKeeper and CLDB nodes. The
-C and -Z parameters are not required when you
specify -R. When -R is specified, the CLDB
credentials are read from mapr-clusters.conf, while the ZooKeeper
credentials are read from warden.conf. Use the -R
option when you make changes to the services configured on a node without changing
the CLDB and ZooKeeper nodes. Specify the --noRecalcMem parameter
to skip recalculating memory settings when refreshing roles.
/opt/mapr/conf/env_override.sh in the following ways: MAPR_JMXLOCALBINDING to true,
running /opt/mapr/server/configure.sh -R sets
MAPR_JMXAUTH to false, since JMX is only
accessible from the local machine and does not require authentication. MAPR_JMXLOCALBINDING to false
but set MAPR_JMXLOCALHOST to true, running
/opt/mapr/server/configure.sh -R sets
MAPR_JMXAUTH to true and
MAPR_JMXSSL to false, since JMX is only
accessible from the local network and does not require secure authentication. MAPR_JMXLOCALBINDING to false
but set MAPR_JMXREMOTEHOST to true, running
/opt/mapr/server/configure.sh -R sets
MAPR_JMXAUTH to true and
MAPR_JMXSSL to true, since JMX is now
accessible remotely and requires secure authentication.-Z-Z option is required unless you specify the
-c (lowercase), or the -R option. The
-Z option takes a comma-separated list of the ZooKeeper nodes in
the cluster. The list is in the following format:
hostname[:port_no][,hostname[:port_no]...]-certdomain--create-user | -a-u parameter, or from the environment variable $MAPR_USER.-D-D option, you cannot specify
partitions. By default, the configure.sh script automatically starts
cluster services, after the configuration finishes successfully. If you do not want
cluster services to be restarted, include the -no-autostart option
along with the -D option.-d-dare-genkeys option, the utility generates the
data-at-rest encryption master key file at
/opt/mapr/conf/dare.master.key.-defaultdbhbase (HBase) when you have mapr-hbase-regionserver
or mapr-hbase-master installed on the node. Otherwise, it defaults to
maprdb (HPE Ezmeral Data Fabric Database). You can also change
the database setting using hbase-site.xml or the HBase client
connection. For more information, see Configure the Default Database for HBase Clients.-disk-opts-disk-opts FW5 to format the disks (F), and configure five disks
per storage pool (W5).-disableSslThe new ZooKeeper (ZK version 3.5.6) supports SSL encryption for server-to-server communication. When you install a new clean 6.2 secure cluster, SSL between ZooKeeper servers is enabled automatically.
However when you perform a rolling upgrade, few nodes are upgraded to data-fabric 6.2 (with the new ZooKeeper server), while other nodes still run the old data-fabric 6.1, where the ZooKeeper is at version 3.4.11 and is incapable of using SSL.
You must disable SSL using this option, to get this hybrid cluster to work. You must enable SSL for ZooKeeper only AFTER you upgrade all nodes to data-fabric 6.2.
You can use this option even when refreshing roles. For
example: configure.sh -R -disableSsl.
configure.sh without this option enables SSL. To turn on SSL: configure.sh -R (without this
disableSsl parameter).sslQuroum parameter in zoo.cfg
controls whether or not the ZooKeeper nodes can use SSL for communication.To verify that ZooKeeper nodes are communicating over SSL, check the ZooKeeper log for messages such as SSL handshake complete with … and/or Accepted TLS connection from....
-dp-ds-du-EC‑hiveMetastoreHost argument to configure an ecosystem component, such
as Drill, to communicate with the Hive Metastore. Use the following format to specify a
list of hosts:hostname[:port_no][,hostname[:port_no]...]See
the -EC parameter example later on this page. If you do not specify a
host port number, Drill uses the default Hive Metastore port number (9083) for every
host.
-EPconfigure.sh script. These commands follow the form
‑EP<ecosystem component name> <option>. In general,
‑EP options are not documented, and should be used only if the
documentation specifically instructs you to use them.configure.sh scripts. The server
configure.sh script or a user, can pass options directly to the
ecosystem component by using the ‑EP syntax. For example, in the
following
command:/opt/mapr/server/configure.sh -R -EPkibana '-kibanaPort 5610'-EPkibana
'-kibanaPort 5610' changes the default port for Kibana to 5610.
As
ecosystem components are updated more frequently than Data Fabric Core (which contains the server
configure.sh script), implementing some
configure.sh functions through an ecosystem
configure.sh script can accelerate the introduction of new
features.
-ES-R parameter.hostname/IPaddress[:port_no][,hostname/IPaddress[:port_no]...]9200. If you want
to use a different port, specify the port number when you list the Elasticsearch
nodes.-ESDBElasticsearch requires a lot of disk space. Therefore, a
separate filesystem for the index is recommended. It is not recommended to store
index data under the / or the /var file
system.
-Fconfigure.sh script automatically starts cluster services after the
configuration finishes successfully. If you do not want cluster services to be
restarted, include the -no-autostart option along with the
-F option.-f-forceSecurityDefaultsconfigure.sh to undo any custom security settings for a
cluster, and reconfigure security to the default data-fabric values for -unsecure or
-secure. You must specify either the -secure or the
-unsecure option. Using the -forceSecurityDefaults
option removes the /opt/mapr/conf/.customSecure file. Use the following
syntax:/opt/mapr/server/configure.sh -forceSecurityDefaults [ -unsecure | -secure ] -C <CLDB_node> -Z <ZK_node>For more information, see Customizing Security in HPE Ezmeral Data Fabric.
-forceSecurityDefaults
operation might not undo all custom security settings since
configure.sh cannot know all of the custom settings that were
implemented. Therefore, you might have to edit some configuration files and settings
to restore the cluster to full functionality.-G-create-user or -a option; corresponds to the
-g or -gid option of the
useradd command in Linux.-g-genkeys-dare option, the
-genkeys option generates a master key at
/opt/mapr/conf/dare.master.key on the first CLDB node. Without
the master key, you cannot start the cluster, nor can you access the
data.-H7443.-HS-MF parameter is myriadA, the name is:
jobhistory.myriadA.mesos. Myriad is not
supported in data-fabric
6.2.0 and later.--isvmconfigure.sh is
run on a cluster node, that is on a virtual machine. This option configures the script
to use less memory.-J7220-JMXEnable-JMXDisable-JMXLocalBindingEnable-JMXLocalBindingDisable-JMXLocalHostEnableJMXRemoteHostEnable. -JMXLocalHostDisable-JMXRemoteHostEnableJMXLocalHostEnable.-JMXRemoteHostDisable-K | -kerberosEnable-Lconfigure.sh logs
errors to /opt/mapr/logs/configure.log.-label--logHTTPFSfluentd.-MCL-MP-MHA-M7-maprpamconfigure.sh script installs the data-fabric version of Pluggable
Authentication Modules (PAM). This option is ignored if -S is not
set.-NSpecifies the cluster name. If you do not specify a name,
configure.sh applies a default name (my.cluster.com) to the
cluster. Whenever you run configure.sh, be aware of the existing
cluster name or names in mapr-clusters.conf and specify the
-N parameter accordingly. If you specify a name that does not
exist, a new line is created in mapr-clusters.conf and is treated as
a configuration for a separate cluster.
Subsequent runs of configure.sh without the -N
parameter operate on this default cluster. If you specify a name when you first run
configure.sh, you can modify the CLDB and ZooKeeper settings
corresponding to the named cluster by specifying the same name and running
configure.sh again. Whenever you need to re-run
configure.sh on a given cluster (to add or rename nodes, for
example), be sure to specify the same cluster name that you used when you ran
configure.sh for the first time.
-no-autostartconfigure.sh.-no-auto-permission-update/etc/shadow.-nocertsconfigure.sh script does not generate SSL
certificates even when the -genkeys option is specified.-noDB-noRecalcMem-R option.-OT-R parameter. The Warden service must be running when you use
configure.sh -R -OT.hostname/IP address[:port_no][,hostname/IP address[:port_no]...]4242. If you want to
use a different port, specify the port number when you list the OpenTSDB
nodes.-on-prompt-conty to automatically respond Yes to all prompts.n to automatically respond No to all prompts.-Pmapr/<instance-name>@<realm-name>. Enclose this value in
quotes ("). This value is ignored if Kerberos security is not enabled.-QS-QS option to configure the OJAI Distributed Query Service.
See Configure the OJAI Distributed Query Service.-RMIn data-fabric 5.1, this
parameter is expanded to support the Mesos DNS-style hostname for Myriad
configuration. The Mesos-style hostname is <application
name>.marathon.mesos. When starting ResourceManager from Marathon, the
.<application name> rm, for example, is
rm.marathon.mesos.
In data-fabric 4.0.2, this parameter is not required unless you want to configure manual or automatic failover; zero configuration failover is enabled by default. In data-fabric 4.0.1, this parameter specifies the nodes in the cluster with the ResourceManager role.
List the nodes in the following format: hostname[,hostname]...]
For more information, see ResourceManager High Availability. Myriad is not supported in data-fabric 6.2.0 and later.
-S | -secureinsecure.-syschk-TLconfigure.sh -TL <timeline_server_node>
on all nodes to indicate where the timeline server resides.-U--create-user or -a option; corresponds to the
-u or --uid option of the useradd
command in Linux.-u-unsecureunsecure.-vstdout.HSM Parameters - For more information, see Setting Up the External KMIP Keystore
-hsmPerforms HSM configuration. This will always run the mrhsm init
command to initialize the HSM if not already initialized. The
-hsmlabel option is required if the -hsm option is
specified for the first time.
When used with the -genkeys option, -hsm invokes
the mrhsm enable command to generate the CLDB and also the DARE keys
if the -dare option is specified.
Otherwise, -hsm configures the settings specified by the
-hsmip, -hsmport, -hsmcacert,
-hsmclientcert, -hsmclientkey and
-hsmkmipversion options, but does not enable the HSM feature or
generate any keys.
-hsmip <ip-address>The comma-separated list of host names or IP addresses of the external HSM. This parameter is required only when no IP addresses have been configured, or when you need to modify the IP addresses of the external HSM.
-hsmport <port>This parameter is optional. If omitted, this
defaults to the standard KMIP port of 5696.
-hsmcacert </path/to/cert>This parameter is required only when no CA certificate has been configured, or when we need to modify the CA certificate.
-hsmclientcert </path/to/cert>This parameter is required only when no client certificate has been configured, or when you need to modify the client certificate.
-hsmclientkey </path/to/key>This parameter is required only when no client key has been configured, or when you need to modify the client key.
-hsmlabel <label>The KMIP token label. This is an ASCII string which is used to describe the KMIP token and can range from 1 to 32 characters, e.g. Utimaco ESKM.
This parameter is only needed when initializing the KMIP token for the first time. It is ignored for subsequent invocations.
-hsmsopin <so-pin>PIN for the Security Officer (SO). This should be between 4 to 255 characters inclusive. The SO PIN is set in the KMIP token during the initial invocation.
In subsequent invocations, the SO PIN entered into this utility must match the configured SO PIN. If this argument is not specified, you will be prompted to enter it.
-hsmkmipversion <version>1.1.At the end of the configure.sh script, the HSM should be up and running, when you use the HSM parameters. Use the mrhsm info command to check the HSM status.
Protection of Java key stores is NOT supported in the HSM for data-fabric 6.2. In later releases,
configure.sh will generate PKCS#12 key stores instead of
JCEKS key stores.
On the new node, run the following command:
/opt/mapr/server/configure.sh -C nodeA,nodeB,nodeC -Z nodeA,nodeB,nodeCOn a Linux client, run the following command:
/opt/mapr/server/configure.sh -N my.cluster.com -c -C nodeAOn a Windows 7 client, run the following command:
C:\opt\mapr\server\configure.bat -N my.cluster.com -c -C nodeAOn a node in the second cluster your.cluster.com, run the following command:
/opt/mapr/server/configure.sh -C nodeZ -N your.cluster.com -Z <zkNodeA,zkNodeB,zkNodeC>In this example, the cluster my.cluster.com has CLDB servers at nodeA, nodeB, nodeC, and nodeD. The CLDB servers nodeB and nodeD have two NICs each at eth0 and eth1.
On a
node in the cluster my.cluster.com, run the following command:
/opt/mapr/server/configure.sh -N my.cluster.com -C nodeAeth0,nodeCeth0 -M \
nodeBeth0,nodeBeth1 -M nodeDeth0,nodeDeth1 -Z zknodeAIn this example, the cluster my.cluster.com has two CLDB servers at nodeA
and nodeB. The ZooKeeper node for this cluster is at nodeC. To start the cluster in secure
mode, run the following command on nodeA:
/opt/mapr/server/configure.sh -N my.cluster.com -C nodeA,nodeB -Z nodeC -secure \
-genkeys -F <disklist file>This command creates the ssl_truststore,
ssl_keystore, maprserverticket, and
cldb.key files. Copy these files from nodeA's
/opt/mapr/conf directory to nodeB's /opt/mapr/conf
directory.
On nodeB, change the permissions on the ssl_keystore,
maprserverticket, and cldb.key files to 600 (the
mapr user) by using the following command:
chmod 600 ssl_keystore maprserverticket cldb.keyOn the ssl_truststore file, change the permissions to 644 (world
readable):
chmod 644 ssl_truststore
On nodeB, run the following command:
/opt/mapr/server/configure.sh -N mycluster.com -C nodeA,nodeB -Z nodeC -secure -F \
<disklist file>This
example uses the -EC parameter to configure the Drill storage plugin to
communicate with a Hive Metastore located on nodeA:
/opt/mapr/server/configure.sh -EC '-hiveMetastoreHost nodeA'A sample session transcript using the
/opt/mapr/server/configure.sh script with DARE enabled is as follows.
The portions in bold relate to the common HSM features, while the portions in
italics relate to the DARE-specific
features:
# /opt/mapr/server/configure.sh -secure -genkeys -N test96.cluster.com -C perfnode96.lab:7222 -Z perfnode96.lab:5181 -F disks.txt -dare -hsm -hsmip 10.10.30.129 -hsmlabel "SafeNet KeySecure" -hsmsopin 12345678 -hsmclientcert /root/safenet-keysecure/client.pem -hsmcacert /root/safenet-keysecure/CA.pem -hsmclientkey /root/safenet-keysecure/key.pem
create /opt/mapr/conf/conf.old
CLDB node list: perfnode96.lab:7222
Zookeeper node list: perfnode96.lab:5181
External Zookeeper node list:
Node setup configuration: cldb fileserver hadoop-util zookeeper
Log can be found at: /opt/mapr/logs/configure.log
Initializing HSM with label SafeNet KeySecure
Generated random user PIN B$V5g%$2#%8Kc6SL
Obtained cluster name test96.cluster.com from mapr-clusters.conf
Enabling MapR HSM on cluster test96.cluster.com
Successfully generated Core KEK, UUID CF9FE63E85EF233B583972FB6265DB33067E8DBBB300297FF8F562DFCF7EA904
Successfully generated Common KEK, UUID 32A903E6D0DF67FDBCD953A33FC2547F50D35C18666E2A0A0B5CF749FBF84D6A
Successfully set encrypted CLDB key in KMIP configuration
Successfully set encrypted DARE key in KMIP configuration
##############################################################################
# NOTE: The DARE master key for data at rest encryption is protected by the #
# HSM. All keys in the HSM, including the DARE master key, should be safely #
# backed up. Without the DARE master key, cluster cannot be started and data #
# cannot be accessed. #
##############################################################################
Creating 100 year self signed certificate with subjectDN='CN=*.lab'
Configuring hadoop-util
/dev/sdb added.
/dev/sdc added.
/dev/sdd added.
Zookeeper found on this node, and it is not running. Starting Zookeeper
Warden is not running. Starting mapr-warden. Warden will then start all other configured services on this node
... Starting cldb
... Starting fileserver
... Starting hadoop-util
To further manage the system, use "maprcli", or connect browser to https://{webserver host name}:8443/
To stop and start this node, use "systemctl start/stop mapr-warden "
No need to set label returning from SetDiskLabel When you run configure.sh with the -OT option for the
first time, you might encounter an error message such as directory /opt/mapr/conf/proxy
is not owned by root. You must ignore this transient error message. If you repeatedly
see this error during client operations, then re-run configure.sh with the
-R option.