默认已安装ranger-admin和mysql服务。Ranger组件服务默认都在/opt/bigdata.test/core/ranger目录下安装。
-
- 解压安装包
hadoop\~\]$ cd /opt/ranger
\[hadoop@ ranger\]$ tar -xzvf ranger-2.1.0-kms.tar.gz
\[hadoop@x ranger\]$ mv ranger-2.1.0-kms ranger/ranger-kms
1.
1. ******修改install.properties******
修改下列属性，没有出现的保持默认
\[hadoop ranger-kms\]$ more install.properties \|grep -v "#"\|grep -v \^$
PYTHON_COMMAND_INVOKER=python
DB_FLAVOR=MYSQL
SQL_CONNECTOR_JAR=/usr/share/java/mysql-connector-java.jar
db_root_user=root
db_root_password=xxxxx
db_host=-hadoop-0014:3318
#启用kerberos影响dbks-site.xml
db_name=rangerkms
db_user=rangerkms
db_password=xxxxx
ranger_kms_http_enabled=true
ranger_kms_https_keystore_file=
ranger_kms_https_keystore_keyalias=rangerkms
ranger_kms_https_keystore_password=
KMS_MASTER_KEY_PASSWD=Str0ngPassw0rd
kms_principal=rangerkms/[email protected]
kms_keytab=/opt/key/rangerkms.keytab
hadoop_conf=/opt/hadoop/etc/hadoop/
#使用hadoop用户启动
unix_user=hadoop
unix_user_pwd=xxxxx
unix_group=hadoop
POLICY_MGR_URL=http://hadoop-0023:6080
REPOSITORY_NAME=kmsdev
SSL_KEYSTORE_FILE_PATH=/opt/ranger/kms/conf/ranger-plugin-keystore.jks
SSL_TRUSTSTORE_FILE_PATH=/opt/ranger/kms/conf/ranger-plugin-truststore.jks
RANGER_KMS_LOG_DIR=/opt/logs/ranger/kms
RANGER_KMS_PID_DIR_PATH=/opt/tmp/run/
1.
1. ******运行**** ****./setup.sh**** ****安装******
使install.properties生效，在$RANGER_HOME/ranger-kms/ews/webapp/WEB-INF/classes/conf下生成kms-site.xml和dbks-site.xml具体配置文件。对应mysql库生成保存密钥的表；
可能会报没权限创建/etc/ranger 需要先创建该目录
之后授权给hadoop权限,需要mkdir /etc/ranger 之后chown hadoop.hadoop /etc/ranger
授权hadoop权限,
后续会自动生成如下目录
执行安装语句
\[root@hadoop-0023 ranger-kms\]# ./setup.sh
....
Ranger Plugin for kms has been enabled. Please restart kms to ensure that changes are effective.
Installation of Ranger KMS is completed.
\[hadoop@x86-hadoop-0023 conf\]$ mysql -uroot -pXXX
MariaDB \[rangerkms\]\> show tables;
+---------------------+
\| Tables_in_rangerkms \|
+---------------------+
\| ranger_keystore \|
\| ranger_masterkey \|
+---------------------+
2 rows in set (0.00 sec)
1.
1. ******修改kms-site.xml******
配置kerberos认证相关属性以及代理用户；任意principal转换成kms做代理。
hadoop@hadoop-0023 \~\]$ cat /opt/ranger/ranger-kms/ews/webapp/WEB-INF/classes/conf/kms-site.xml \|grep -v "#"\|grep -v \^$
\