Grant dfsadmin privilege or this alternative to the Unravel user.

To grant this privilege, set/update the HDFS configuration property dfs.cluster.administrators and restart all services affected by this change.

If you can't grant dfsadmin privilege to the Unravel user, follow the steps in the Troubleshooting section of Triggering an import of FSImage. These steps allow Unravel to use the FSimage you import manually.

Remove the following line from /usr/local/unravel/ondemand/unravel-python-1.0.0/scripts/fsimage_reports/hive/hive_properties.hql:

ADD JAR {UDF_JAR_LOC}/unravel-udf-0.2.jar

This line is no longer required because UDFs jars are stored locally on the HiveServer2 node in Sentry-secured CDH clusters.

Allow the Unravel user to submit Hive queries to a YARN queue.

If you can't allow this on your default YARN queue, you can grant this permission on a different YARN queue:

1. Create a different YARN queue for the Unravel user.

2. Give the Unravel user permission to submit Hive queries to the new YARN queue.

3. In unravel.properties on the Unravel server set unravel.python.reporting.files.hive_mr_queue to the new YARN queue. For details on this property, see Unravel Properties.

Create a new Sentry role, unravel_role, using the beeline CLI as the Hive admin user (hive by default).

create role unravel_role

Map the unravel group to unravel_role:

grant role unravel_role to group unravel

Set HDFS access privileges for the Unravel user:

The Unravel user needs to copy FSImage to /tmp/fsimage, so allow this access as follows:

grant all on uri 'hdfs:///tmp/fsimage' to role unravel_role;

Grant the Unravel user the following privileges on the Hive tables under the default database:

1. Create/drop/truncate/alter Hive tables

2. Run/select/insert queries on Hive tables

   Alternatively, you can:

   • Use a different database for the Unravel user, such as unravel_db.

   • Give the Unravel user the above permissions on that database:

     grant all on database unravel_db to role unravel_role;

3. In unravel.properties on the Unravel server set unravel.python.reporting.files.hive_database to the alternate database. For details on this property, see Unravel Properties.

   For example,

   unravel.python.reporting.files.hive_database=unravel_db

Add a JAR and create temporary UDFs:

1. As the Unravel user, copy the Unravel JAR, /usr/local/unravel/ondemand/unravel-python-1.0.0/jars/fsimage_reports/unravel-udf-0.2.jar, to the HiveServer2 aux JAR path.

2. Hive user and group should own this JAR.

   For example, if the HiveServer2 aux JAR path is /tmp/hive_jars, this directory and the copied jar must be owned by hive admin user ( hive by default):

   chown -R hive:hive /tmp/hive_jars

3. Grant the Unravel user access to this JAR:

   grant all on uri 'file:///tmp/hive_jars/' to role unravel_role;

4. In Cloudera Manager, restart HiveServer2.

Use the show grant role unravel_role command to verify that permissions now look like this:

+--------------------------------------------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+

|                  database                  | table  | partition  | column  | principal_name  | principal_type  | privilege  | grant_option  |    grant_time     | grantor  |

+--------------------------------------------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+

| file:///tmp/hive_jars/unravel-udf-0.2.jar  |        |            |         | unravel_role    | ROLE            | *          | false         | 1550829915318000  | --       |

| unravel_db                                 |        |            |         | unravel_role    | ROLE            | *          | false         | 1550829820331000  | --       |

| hdfs:///tmp/fsimage                        |        |            |         | unravel_role    | ROLE            | *          | false         | 1550830532328000  | --       |

+--------------------------------------------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+

Grant dfsadmin access or this alternative to the Unravel user.

For example:

Allow the Unravel user to connect to HiveServer2.

Allow the Unravel user to CREATE, TRUNCATE, ALTER, DROP, INSERT, and SELECT Hive tables.

For example:

Allow the Unravel user to change or switch the Hive database. Add unravel user with "s;ec

For example:

Allow the Unravel user to submit Hive queries to a particular YARN queue.

For example:

Allow the Unravel user to use concurrent Hive queries:

Set hive.txn.manager=DbTxnManager and hive.support.concurrency=true in Hive configuration.

The Unravel user must be able to set the following properties dynamically:

1. Set the following parameters in custom hive-site properties.

   hive.auto.convert.join
   hive.support.sql11.reserved.keywords
   hive.variable.substitute
   mapred.job.queue.name
   mapreduce.map.java.opts
   mapreduce.map.memory.mb
   

   This can be done by setting the following key/value pair in custom hive-site.xml.

   property name = hive.security.authorization.sqlstd.confwhitelist.append
   property value = 
   hive\\.auto\.convert\.join|hive\.support\.concurrency|hive\.support\.sql11\.reserved\.keywords|hive\.txn\.manager|hive\.variable\.substitute|mapred\.job\.queue\.name|mapreduce\.map\.java\.opts|mapreduce\.map\.memory\.mb

2. Allow Unravel user TempUDFAdmin privileges at global level.