Skip to main content

Spark Hadoop EMR Cross Realm Access HBase & Kafka

By Dinesh

 

  • We had in-premise Hadoop Cluster which included Kafka, HBase, HDFS, Spark, YARN , etc.
  • We planned to migrate our Big Data Jobs and Data to AWS EMR but still keeping Kafka on in-premise CDP cluster.
  • After Spawning EMR on AWS. We tried running Spark Job connecting to Kafka on in-premise cluster.
    • We did setup all VPC connections & opened 2firewall ports between the two clusters.
    • But, since EMR and CDP (in-premise) had different KDC Server & principal, it kept on failing for us to connect to Kafka ( in-premise) from EMR.
    • Note, one can set following property to see Kerberos logs - 
      • -Dsun.security.krb5.debug=true
The easiest option for us were two - 
  • Setup Cross-Realm Kerberos trust. Such that EMR principal in-premise KDC Server to use kafka service. Refer - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/using_trusts
  • Setup to Cross-Realm trust using same AD accounts and domain. Refer https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-kerberos-cross-realm.html
But, Our Security team did not agree on above options, which would have made developers life a lot easier. 

So, We copied in-premise Keytab on to EMR, and tried to use that to authenticate with Kafka service. We don't recommend doing it, but we had not other option. Steps are described as below.
  • Update krb5.conf  such that it aware about both the cluster domains, kdc servers, etc.

[libdefaults]

    default_realm = EMR.LOCAL
    dns_lookup_realm = false
    udp_preference_limit = 1
    dns_lookup_kdc = false
    rdns = true
    ticket_lifetime = 24h
    forwardable = true
    default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1
    default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1
    permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1

[realms]
    EMR.LOCAL = {
kdc = ip-90-110-43-74.ec2.internal:88
admin_server = ip-90-110-43-74.ec2.internal:749
default_domain = ec2.internal
    }

CDP.INPREMISE.COM = {
kdc = cdp42.cdp.inpremise.com:88
master_kdc = cdp42.cdp.inpremise.com:88
kpasswd = cdp42.cdp.inpremise.com:464
kpasswd_server = cdp42.cdp.inpremise.com:464
}

[domain_realm]
    .ec2.internal = EMR.LOCAL
     ec2.internal = EMR.LOCAL
    cdp42.cdp.inpremise.com = CDP.INPREMISE.COM
    .cdp.inpremise.com = CDP.INPREMISE.COM

[logging]
    kdc = FILE:/var/log/kerberos/krb5kdc.log
    admin_server = FILE:/var/log/kerberos/kadmin.log
    default = FILE:/var/log/kerberos/krb5lib.log


Note - details can be found here https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html#domain-realm


  • Then we did write jaas.conf as below - 
KafkaClient{
  com.sun.security.auth.module.Krb5LoginModule required
  doNotPrompt=true
  useTicketCache=false
  principal="inpremiseaccount@CDP.INPREMISE.COM"
  useKeyTab=true
  serviceName="kafka"
  keyTab="inpremiseaccount.keytab"
  renewTicket=true
  storeKey=true
  client=true;
};
Client {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  doNotPrompt=true
  useTicketCache=false
  serviceName="hbase"
  keyTab="awsemraccount.keytab"
  principal="awsemraccount@EMR.LOCAL"
  storeKey=true
  client=true;
};

Note that - 
  1. KafkaClient has configuration to connect to in-premise kafka server running on CDP.
  2. Client on the other hand includes configuration to connect to EMR HBase service.
  3. As our target is to run a Spark job on EMR, which reads data from a different Kafka cluster and saves data to EMR HBase.
Once above was done then our Spark command looked like below - 

INPREMISEACCOUNT_KEYTAB_PATH= <My_path>/inpremiseaccount.keytab
JAAS_PATH=<My_path>/jaas.conf
TRUSTSTORE_PATH=<My_path>/trustore.jks
KRB5_PATH=<My_path>/krb5.conf
EMRACCOUNT_KEYTAB_PATH=<My_path>/awsemraccount.keytab

spark-shell --master yarn \
 --num-executors 2 \
 --conf "spark.dynamicAllocation.enabled=false" \
 --conf "spark.shuffle.service.enabled=false" \
 --jars $mylib \
 --conf spark.executor.extraJavaOptions=" -Djava.security.auth.login.config=jaas.conf -Djava.security.krb5.conf=krb5.conf" \
--driver-java-options " -Djava.security.auth.login.config=jaas.conf -Djava.security.krb5.conf=krb5.conf" \
--files "$INPREMISEACCOUNT_KEYTAB_PATH,$JAAS_PATH,$TRUSTSTORE_PATH,$KRB5_PATH" \
--conf "spark.yarn.keytab=$EMRACCOUNT_KEYTAB_PATH" \
--conf "spark.yarn.principal=awsemraccount@EMR.LOCAL"

Comments

Post a Comment

Popular posts

Spark MongoDB Connector Not leading to correct count or data while reading

By Dinesh
  We are using Scala 2.11 , Spark 2.4 and Spark MongoDB Connector 2.4.4 Use Case 1 - We wanted to read a Shareded Mongo Collection and copy its data to another Mongo Collection. We noticed that after Spark Job successful completion. Output MongoDB did not had many records. Use Case 2 -  We read a MongoDB collection and doing count on dataframe lead to different count on each execution. Analysis,  We realized that MongoDB Spark Connector is missing data on bulk read as a dataframe. We tried various partitioner, listed on page -  https://www.mongodb.com/docs/spark-connector/v2.4/configuration/  But, none of them worked for us. Finally, we tried  MongoShardedPartitioner  this lead to constant count on each execution. But, it was greater than the actual count of records on the collection. This seems to be limitation with MongoDB Spark Connector. But,  MongoShardedPartitioner  seemed closest possible solution to this kind of situation. But, it per...
Post a Comment
Read more




Scala Spark building Jar leads java.lang.StackOverflowError

By Dinesh
  Exception -  [Thread-3] ERROR scala_maven.ScalaCompileMojo - error: java.lang.StackOverflowError [Thread-3] INFO scala_maven.ScalaCompileMojo - at scala.collection.generic.TraversableForwarder$class.isEmpty(TraversableForwarder.scala:36) [Thread-3] INFO scala_maven.ScalaCompileMojo - at scala.collection.mutable.ListBuffer.isEmpty(ListBuffer.scala:45) [Thread-3] INFO scala_maven.ScalaCompileMojo - at scala.collection.mutable.ListBuffer.toList(ListBuffer.scala:306) [Thread-3] INFO scala_maven.ScalaCompileMojo - at scala.collection.mutable.ListBuffer.result(ListBuffer.scala:300) [Thread-3] INFO scala_maven.ScalaCompileMojo - at scala.collection.mutable.Stack$StackBuilder.result(Stack.scala:31) [Thread-3] INFO scala_maven.ScalaCompileMojo - at scala.collection.mutable.Stack$StackBuilder.result(Stack.scala:27) [Thread-3] INFO scala_maven.ScalaCompileMojo - at scala.collection.generic.GenericCompanion.apply(GenericCompanion.scala:50) [Thread-3] INFO scala_maven.ScalaCompile...
Post a Comment
Read more




MongoDB Chunk size many times bigger than configure chunksize (128 MB)

By Dinesh
  Shard Shard_0 at Shard_0/xyz.com:27018 { data: '202.04GiB', docs: 117037098, chunks: 5, 'estimated data per chunk': '40.4GiB', 'estimated docs per chunk': 23407419 } --- Shard Shard_1 at Shard_1/abc.com:27018 { data: '201.86GiB', docs: 116913342, chunks: 4, 'estimated data per chunk': '50.46GiB', 'estimated docs per chunk': 29228335 } Per MongoDB-  Starting in 6.0.3, we balance by data size instead of the number of chunks. So the 128MB is now only the size of data we migrate at-a-time. So large data size per chunk is good now, as long as the data size per shard is even for the collection. refer -  https://www.mongodb.com/community/forums/t/chunk-size-many-times-bigger-than-configure-chunksize-128-mb/212616 https://www.mongodb.com/docs/v6.0/release-notes/6.0/#std-label-release-notes-6.0-balancing-policy-changes
Post a Comment
Read more




Hive Parse JSON with Array Columns and Explode it in to Multiple rows.

By Dinesh
 Say we have a JSON String like below -  { "billingCountry":"US" "orderItems":[       {          "itemId":1,          "product":"D1"       },   {          "itemId":2,          "product":"D2"       }    ] } And, our aim is to get output parsed like below -  itemId product 1 D1 2 D2   First, We can parse JSON as follows to get JSON String get_json_object(value, '$.orderItems.itemId') as itemId get_json_object(value, '$.orderItems.product') as product Second, Above will result String value like "[1,2]". We want to convert it to Array as follows - split(regexp_extract(get_json_object(value, '$.orderItems.itemId'),'^\\["(.*)\\"]$',1),'","') as itemId split(regexp_extract(get_json_object(value, '$.orderItems.product'),'^\\["(.*)\\"]$',1),...
Post a Comment
Read more




AWS EMR Spark – Much Larger Executors are Created than Requested

By Dinesh
  Starting EMR 5.32 and EMR 6.2 you can notice that Spark can launch much larger executors that you request in your job settings. For example - We started a Spark Job with  spark.executor.cores  =   4 But, one can see that the executors with 20 cores (instead of 4 as defined by spark.executor.cores) were launched. The reason for allocating larger executors is that there is a AWS specific Spark option spark.yarn.heterogeneousExecutors.enabled (exists in EMR only, does not exist in Open Source Spark) that is set to true by default that combines multiple executor creation requests on the same node into a larger executor container. So as the result you have fewer executor containers than you expected, each of them has more memory and cores that you specified. If you disable this option (--conf "spark.yarn.heterogeneousExecutors.enabled=false"), EMR will create containers with the specified spark.executor.memory and spark.executor.cores settings and will not co...
Post a Comment
Read more