Accessing OBS Using HetuEngine Through Guardian

Prerequisites

If you interconnected Guardian with OBS by referring to Enabling Ranger OBS Path Authentication for Guardian, ensure that you have the read and write permissions on the OBS path in Ranger. For details about how to obtain the permissions, see Configuring Ranger Permissions.

Interconnecting HetuEngine with OBS

In an MRS cluster, Location can be set to an OBS file system path during HetuEngine table creation and HetuEngine can connect to OBS through Hive Metastore.

• Setting Location to the OBS file system path when creating a table
  1. If a HetuEngine compute instance is running, restart it.

     Log in to FusionInsight Manager as a user who has permission to access the HetuEngine web UI. Choose Cluster > Services > HetuEngine. In the Basic Information area in the Dashboard tab, click the link next to HSConsole WebUI. On the displayed HSConsole page, click Compute Instance. In the instance list, click Restart in the Operation column and operate as prompted.

  2. Log in to the node where the HetuEngine service client is located as the client installation user and run the following command:

     source Client installation directory/bigdata_env

  3. Log in to the HetuEngine client.
     • If the cluster has enabled Kerberos authentication (security mode), run the following command to complete user authentication and log in to the HetuEngine client:

       Authenticate the user.

       kinit User performing HetuEngine operations

       Log in to the HetuEngine client.

       hetu-cli --catalog hive --tenant default --schema default

     • Kerberos authentication is not enabled for the cluster (normal mode): Run the following command to log in to the HetuEngine client:

       hetu-cli --catalog hive --tenant default --schema default --user User performing HetuEngine operations

  4. Set Location to the OBS file system path when creating a table.

     create table test(name string) with (location = 'obs://OBS parallel file system name/user/hive/warehouse/test');

• Interconnecting with OBS through Hive Metastore
  1. Complete the configurations by referring to Interconnecting Hive with OBS using MetaStore.
  2. Log in to FusionInsight Manager, choose Cluster > Services > HetuEngine. On the displayed page, choose More > Synchronize Configuration. After the synchronization is complete, choose More > Synchronize Configuration again and then restart the HetuEngine service as prompted.

     If a HetuEngine compute instance is running, stop it before restarting the service. After the service is restarted, start this compute instance.

  3. No location needs to be specified when you log in to the HetuEngine client to create a schema or table. The schema or table is stored on OBS by default.

Configuring Ranger Permissions

For HetuEngine clusters with Kerberos authentication enabled (security mode), the methods to grant Ranger permission are the same for both storage-compute decoupled architecture and storage-compute coupled architecture. For details, see Adding a Ranger Access Permission Policy for HetuEngine.

Before configuring permission policies for OBS paths on Ranger, ensure that the AccessLabel function has been enabled for OBS. For how to enable it, contact OBS O&M personnel.