Security Configuration

Kerberos / SPNEGO Authentication

When the cluster has Kerberos enabled, Celeborn automatically configures NEGOTIATE for HTTP endpoints. Ambari auto-configures the following properties:

Bash

celeborn.master.http.auth.supportedSchemes=NEGOTIATE

celeborn.master.http.spnego.keytab=/etc/security/keytabs/spnego.service.keytab

celeborn.master.http.spnego.principal=HTTP/_HOST@REALM

Bash

# Enable SSL for RPC traffic

celeborn.ssl.rpc_service.enabled=true

celeborn.ssl.rpc_service.keyStore=/path/to/keystore.jks

celeborn.ssl.rpc_service.keyStorePassword=<password>

celeborn.ssl.rpc_service.trustStore=/path/to/truststore.jks

celeborn.ssl.rpc_service.trustStorePassword=<password>

# Enable SSL for data transfer channels

celeborn.ssl.push.enabled=true

celeborn.ssl.fetch.enabled=true

celeborn.ssl.replicate.enabled=true

Bash

celeborn.auth.enabled=true

celeborn.internal.port.enabled=true

celeborn.master.internal.endpoints=master1:19097,master2:19097,master3:19097