瀏覽代碼

[beeswax] Connection to Hive/Beeswax does not need client certificates

We keep them optional just in case but do not display them in the hue.ini anymore

HiveServer2 SSL detection now happens with looking at hive.server2.use.SSL property.
Romain Rigaux 10 年之前
父節點
當前提交
af0c507dfe

+ 4 - 11
apps/beeswax/src/beeswax/conf.py

@@ -100,13 +100,6 @@ SSL = ConfigSection(
   key='ssl',
   help=_t('SSL configuration for the server.'),
   members=dict(
-    ENABLED = Config(
-      key="enabled",
-      help=_t("SSL communication enabled for this server."),
-      type=coerce_bool,
-      default=False
-    ),
-
     CACERTS = Config(
       key="cacerts",
       help=_t("Path to Certificate Authority certificates."),
@@ -116,16 +109,16 @@ SSL = ConfigSection(
 
     KEY = Config(
       key="key",
-      help=_t("Path to the private key file."),
+      help=_t("Path to the private key file, e.g. /etc/hue/key.pem"),
       type=str,
-      default="/etc/hue/key.pem"
+      default=None
     ),
 
     CERT = Config(
       key="cert",
-      help=_t("Path to the public certificate file."),
+      help=_t("Path to the public certificate file, e.g. /etc/hue/cert.pem"),
       type=str,
-      default="/etc/hue/cert.pem"
+      default=None
     ),
 
     VALIDATE = Config(

+ 5 - 0
apps/beeswax/src/beeswax/hive_site.py

@@ -46,6 +46,8 @@ _CNF_HIVESERVER2_KERBEROS_PRINCIPAL = 'hive.server2.authentication.kerberos.prin
 _CNF_HIVESERVER2_AUTHENTICATION = 'hive.server2.authentication'
 _CNF_HIVESERVER2_IMPERSONATION = 'hive.server2.enable.doAs'
 
+_CNF_HIVESERVER2_USE_SSL = 'hive.server2.use.SSL'
+
 _CNF_HIVESERVER2_TRANSPORT_MODE = 'hive.server2.transport.mode'
 _CNF_HIVESERVER2_THRIFT_HTTP_PORT = 'hive.server2.thrift.http.port'
 _CNF_HIVESERVER2_THRIFT_HTTP_PATH = 'hive.server2.thrift.http.path'
@@ -130,6 +132,9 @@ def hiveserver2_impersonation_enabled():
 def hiveserver2_jdbc_url():
   return 'jdbc:hive2://%s:%s/default' % (beeswax.conf.HIVE_SERVER_HOST.get(), beeswax.conf.HIVE_SERVER_PORT.get())
 
+def hiveserver2_use_ssl():
+  return get_conf().get(_CNF_HIVESERVER2_USE_SSL, 'FALSE').upper() == 'TRUE'
+
 def hiveserver2_transport_mode():
   return get_conf().get(_CNF_HIVESERVER2_TRANSPORT_MODE, 'TCP').upper()
 

+ 4 - 2
apps/beeswax/src/beeswax/server/dbms.py

@@ -24,14 +24,16 @@ from django.utils.encoding import force_unicode
 from django.utils.translation import ugettext as _
 
 from beeswax import hive_site
-from beeswax.conf import HIVE_SERVER_HOST, HIVE_SERVER_PORT, BROWSE_PARTITIONED_TABLE_LIMIT, SSL
+from beeswax.conf import HIVE_SERVER_HOST, HIVE_SERVER_PORT, BROWSE_PARTITIONED_TABLE_LIMIT
 from beeswax.design import hql_query
+from beeswax.hive_site import hiveserver2_use_ssl
 from beeswax.models import QueryHistory, QUERY_TYPES
 
 from filebrowser.views import location_to_url
 from desktop.lib.django_util import format_preserving_redirect
 
 
+
 LOG = logging.getLogger(__name__)
 
 DBMS_CACHE = {}
@@ -83,7 +85,7 @@ def get_query_server_config(name='beeswax', server=None):
         'server_port': HIVE_SERVER_PORT.get(),
         'principal': kerberos_principal,
         'http_url': '%(protocol)s://%(host)s:%(port)s/%(end_point)s' % {
-            'protocol': 'https' if SSL.ENABLED.get() else 'http',
+            'protocol': 'https' if hiveserver2_use_ssl() else 'http',
             'host': HIVE_SERVER_HOST.get(),
             'port': hive_site.hiveserver2_thrift_http_port(),
             'end_point': hive_site.hiveserver2_thrift_http_path()

+ 3 - 1
apps/beeswax/src/beeswax/server/hive_server2_lib.py

@@ -38,10 +38,12 @@ from TCLIService.ttypes import TOpenSessionReq, TGetTablesReq, TFetchResultsReq,
 
 from beeswax import conf as beeswax_conf
 from beeswax import hive_site
+from beeswax.hive_site import hiveserver2_use_ssl
 from beeswax.models import Session, HiveServerQueryHandle, HiveServerQueryHistory
 from beeswax.server.dbms import Table, NoSuchObjectException, DataTable,\
                                 QueryServerException
 
+
 LOG = logging.getLogger(__name__)
 
 IMPALA_RESULTSET_CACHE_SIZE = 'impala.resultset.cache.size'
@@ -450,7 +452,7 @@ class HiveServerClient:
       validate = impala_conf.SSL.VALIDATE.get()
       timeout = impala_conf.SERVER_CONN_TIMEOUT.get()
     else:
-      ssl_enabled = beeswax_conf.SSL.ENABLED.get()
+      ssl_enabled = hiveserver2_use_ssl()
       ca_certs = beeswax_conf.SSL.CACERTS.get()
       keyfile = beeswax_conf.SSL.KEY.get()
       certfile = beeswax_conf.SSL.CERT.get()

+ 4 - 4
apps/impala/src/impala/conf.py

@@ -97,16 +97,16 @@ SSL = ConfigSection(
 
     KEY = Config(
       key="key",
-      help=_t("Path to the private key file."),
+      help=_t("Path to the private key file, e.g. /etc/hue/key.pem"),
       type=str,
-      default="/etc/hue/key.pem"
+      default=None
     ),
 
     CERT = Config(
       key="cert",
-      help=_t("Path to the public certificate file."),
+      help=_t("Path to the public certificate file, e.g. /etc/hue/cert.pem"),
       type=str,
-      default="/etc/hue/cert.pem"
+      default=None
     ),
 
     VALIDATE = Config(

+ 0 - 15
desktop/conf.dist/hue.ini

@@ -817,18 +817,9 @@
   ## thrift_version=7
 
   [[ssl]]
-    # SSL communication enabled for this server.
-    ## enabled=false
-
     # Path to Certificate Authority certificates.
     ## cacerts=/etc/hue/cacerts.pem
 
-    # Path to the private key file.
-    ## key=/etc/hue/key.pem
-
-    # Path to the public certificate file.
-    ## cert=/etc/hue/cert.pem
-
     # Choose whether Hue should validate certificates received from the server.
     ## validate=true
 
@@ -873,12 +864,6 @@
     # Path to Certificate Authority certificates.
     ## cacerts=/etc/hue/cacerts.pem
 
-    # Path to the private key file.
-    ## key=/etc/hue/key.pem
-
-    # Path to the public certificate file.
-    ## cert=/etc/hue/cert.pem
-
     # Choose whether Hue should validate certificates received from the server.
     ## validate=true
 

+ 0 - 18
desktop/conf/pseudo-distributed.ini.tmpl

@@ -821,22 +821,10 @@
   # Thrift version to use when communicating with HiveServer2.
   ## thrift_version=7
 
-  # The underlying mode of the Thrift Transport: socket or http
-  ## transport_mode=socket
-
   [[ssl]]
-    # SSL communication enabled for this server.
-    ## enabled=false
-
     # Path to Certificate Authority certificates.
     ## cacerts=/etc/hue/cacerts.pem
 
-    # Path to the private key file.
-    ## key=/etc/hue/key.pem
-
-    # Path to the public certificate file.
-    ## cert=/etc/hue/cert.pem
-
     # Choose whether Hue should validate certificates received from the server.
     ## validate=true
 
@@ -881,12 +869,6 @@
     # Path to Certificate Authority certificates.
     ## cacerts=/etc/hue/cacerts.pem
 
-    # Path to the private key file.
-    ## key=/etc/hue/key.pem
-
-    # Path to the public certificate file.
-    ## cert=/etc/hue/cert.pem
-
     # Choose whether Hue should validate certificates received from the server.
     ## validate=true