Hadoop cluster operations and security
You operate HDFS and YARN and keep the cluster secure and running with high availability, resource queues, Kerberos, Ranger policies, audit logs and backups.
Level 301 · 16 lessons · 12 practice labs
Lessons
Running the cluster
- Node roles and configuration files
- Cluster health: dfsadmin reports and metrics
- The balancer and decommissioning nodes
- NameNode high availability
- Quick task: retire a failing node safely
Resource management
- YARN queues and the capacity scheduler
- Job logs and diagnostics
- Quick task: a dedicated queue for SOC jobs
Security
- Authentication with Kerberos
- Keytabs and service principals
- Central authorisation policies with Ranger
- Encryption in transit
- Reviewing the HDFS audit log
- Quick task: move user access to Kerberos
Recovery
- Backup and cross-cluster copy with DistCp
- Capstone: an operations and security review of an inherited cluster
Practice labs
- A cluster health report: Pull live and dead nodes, used capacity and the under-replicated block count from the dfsadmin report and summarise them.
- Balance uneven nodes: Run the balancer with a suitable threshold on a cluster where one DataNode is full and another empty and show the distribution before and after.
- Decommission a node without losing data: Put a failing DataNode through decommissioning and prove with fsck that its blocks have moved and nothing is under-replicated.
- Read queue usage: From the capacity scheduler's queue status, report which queue is full, which is idle and which applications are waiting.
- A separate queue for security jobs: Define a queue that guarantees the security team 30 per cent capacity and allow only that team's group to submit jobs to it.
- Find the job choking the cluster: Find the application eating all resources and starving the others and set queue limits so no single user can monopolise the cluster.
- Get and verify a ticket: Obtain a Kerberos ticket with the supplied keytab and show authenticated access to HDFS and the ticket's expiry time.
- Prepare a keytab for a service account: Create a service principal and keytab for an ingestion job and set the file permissions so only the service user can read it.
- Find unauthorised access in the audit log: Find denied accesses and the unexpected account reading a sensitive folder in the HDFS audit log and report them with a timeline.
- Copy a folder with DistCp: Copy the daily archive folder to the backup location with DistCp and verify the file count and total size match.
- Copy only what changed: Run DistCp with update and snapshot-diff options and show from the log that only changed files were transferred.
- A restore-from-backup drill: Restore a deleted week of data from the backup location and report integrity, by checksum comparison, and the time taken.
About this course
You operate HDFS and YARN and keep the cluster secure and running with high availability, resource queues, Kerberos, Ranger policies, audit logs and backups.
What you will learn
- Running the cluster
- Resource management
- Security
- Recovery
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.