Prerequisite

• krb5.conf 或 krb5.ini
• xx.keytab
• core-site.xml
• hbase-core.xml

Codes

hBaseConfig.addResource("hbase-site.xml")
hBaseConfig.addResource("core-site.xml")
UserGroupInformation.setConfiguration(hBaseConfig);
UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI("
 
[email protected]", keyTab);
UserGroupInformation.setLoginUser(ugi);
ugi.doAs(new PrivilegedAction<Void>() {
  public Void run() {
    connection = ConnectionFactory.createConnection(conf);
    //hbase operation
    return null;
  }
});

Submit cmd

spark-submit --class com.myclass \
--master yarn \
 
--deploy-mode cluster \
--num-executors 2 \
--driver-memory 1G \
--executor-memory 1G \
--executor-cores 2 \
--queue myqueue \
--conf spark.app.name=MyAPP \
--conf spark.streaming.kafka.maxRatePerPartition=100 \
--conf spark.streaming.stopGracefullyOnShutDown=true \
--conf spark.yarn.security.credentials.hbase.enable=true
 
 \
--conf spark.driver.extraJavaOptions='-Dlog4j.configuration=log4j -Djava.security.krb5.conf=krb5.conf -Dkeytab.file=mykeytab.keytab' \
--conf spark.executor.extraJavaOptions='-Dlog4j.configuration=log4j -Djava.security.krb5.conf=krb5.conf -Dkeytab.file=mykeytab.keytab' \
--conf spark.yarn.dist.archives=/path/core-site.xml,/path/hbase-site.xml,/path/krb5.conf,/path/mykeytab.keytab,/path/log4j.properties / \
/path/myproject-1.0-SNAPSHOT.jar

TIPS

1. spark yarn 模式下提交時可用--files, --conf spark.yarn.dist.archives, --conf spark.yarn.dist.files 後接逗號分隔符的檔案全路徑將檔案提交到每個執行節點.
2. spark yarn 模式下測試情況來看只能用ugi.doAs形式訪問HBase,否則會報錯認證不通過.
3. 如果使用submit命令中使用了--keytab和--principal,--conf spark.yarn.dist.archives提交的keytab檔案會找不到. 詳情參照spark官方文件security和yarn

References