AMBARI-15770: HAWQ fails to connect to YARN in HA+SEC mode (Alexander Denissov via mithmatt)

ambari-server/src/main/resources/common-services/HAWQ/2.0.0/kerberos.json

@@ -35,6 +35,17 @@
           "hdfs-client": {
             "hadoop.security.authentication": "kerberos"
           }
+        },
+        {
+          "yarn-client": {
+            "hadoop.security.authentication": "kerberos"
+          }
+        },
+        {
+          "core-site": {
+            "hadoop.proxyuser.postgres.hosts": "*",
+            "hadoop.proxyuser.postgres.groups": "${cluster-env/user_group}"
+          }
         }
       ],
       "components" : [

ambari-server/src/main/resources/common-services/HAWQ/2.0.0/package/scripts/common.py

@@ -38,6 +38,7 @@ def setup_user():
   Creates HAWQ user home directory and sets up the correct ownership.
   """
   __create_hawq_user()
+  __create_hawq_user_secured()
   __set_home_dir_ownership()
 
 
@@ -54,6 +55,18 @@ def __create_hawq_user():
        groups=[hawq_constants.hawq_group, params.user_group],
        ignore_failures=True)
 
+def __create_hawq_user_secured():
+  """
+  Creates HAWQ secured headless user belonging to hadoop group.
+  """
+  import params
+  Group(hawq_constants.hawq_group_secured, ignore_failures=True)
+
+  User(hawq_constants.hawq_user_secured,
+       gid=hawq_constants.hawq_group_secured,
+       groups=[hawq_constants.hawq_group_secured, params.user_group],
+       ignore_failures=True)
+
 def create_master_dir(dir_path):
   """
   Creates the master directory (hawq_master_dir or hawq_segment_dir) for HAWQ

ambari-server/src/main/resources/common-services/HAWQ/2.0.0/package/scripts/hawq_constants.py

@@ -34,6 +34,7 @@ root_user = "root"
 hawq_user = "gpadmin"
 hawq_user_secured = "postgres"
 hawq_group = hawq_user
+hawq_group_secured = hawq_user_secured
 
 # Directories
 hawq_home_dir = "/usr/local/hawq/"

ambari-server/src/test/python/stacks/2.3/HAWQ/test_hawqmaster.py

@@ -27,6 +27,7 @@ class TestHawqMaster(RMFTestCase):
   COMMON_SERVICES_PACKAGE_DIR = 'HAWQ/2.0.0/package'
   STACK_VERSION = '2.3'
   GPADMIN = 'gpadmin'
+  POSTGRES = 'postgres'
   DEFAULT_IMMUTABLE_PATHS = ['/apps/hive/warehouse', '/apps/falcon', '/mr-history/done', '/app-logs', '/tmp']
 
   def __asserts_for_configure(self):
@@ -42,6 +43,16 @@ class TestHawqMaster(RMFTestCase):
         password = 'saNIJ3hOyqasU'
         )
 
+    self.assertResourceCalled('Group', self.POSTGRES,
+        ignore_failures = True
+        )
+
+    self.assertResourceCalled('User', self.POSTGRES,
+        gid = self.POSTGRES,
+        groups = [self.POSTGRES, u'hadoop'],
+        ignore_failures = True
+        )
+
     self.assertResourceCalled('Execute', 'chown -R gpadmin:gpadmin /usr/local/hawq/',
         timeout = 600
         )

ambari-server/src/test/python/stacks/2.3/HAWQ/test_hawqsegment.py

@@ -25,6 +25,7 @@ class TestHawqSegment(RMFTestCase):
   COMMON_SERVICES_PACKAGE_DIR = 'HAWQ/2.0.0/package'
   STACK_VERSION = '2.3'
   GPADMIN = 'gpadmin'
+  POSTGRES = 'postgres'
 
   def __asserts_for_configure(self):
 
@@ -39,6 +40,16 @@ class TestHawqSegment(RMFTestCase):
         password = 'saNIJ3hOyqasU'
         )
 
+    self.assertResourceCalled('Group', self.POSTGRES,
+        ignore_failures = True
+        )
+
+    self.assertResourceCalled('User', self.POSTGRES,
+        gid = self.POSTGRES,
+        groups = [self.POSTGRES, u'hadoop'],
+        ignore_failures = True
+        )
+
     self.assertResourceCalled('Execute', 'chown -R gpadmin:gpadmin /usr/local/hawq/',
         timeout = 600
         )

ambari-server/src/test/python/stacks/2.3/HAWQ/test_hawqstandby.py

@@ -26,6 +26,7 @@ class TestHawqStandby(RMFTestCase):
   COMMON_SERVICES_PACKAGE_DIR = 'HAWQ/2.0.0/package'
   STACK_VERSION = '2.3'
   GPADMIN = 'gpadmin'
+  POSTGRES = 'postgres'
 
   def __asserts_for_configure(self):
 
@@ -40,6 +41,16 @@ class TestHawqStandby(RMFTestCase):
         password = 'saNIJ3hOyqasU'
         )
 
+    self.assertResourceCalled('Group', self.POSTGRES,
+        ignore_failures = True
+        )
+
+    self.assertResourceCalled('User', self.POSTGRES,
+        gid = self.POSTGRES,
+        groups = [self.POSTGRES, u'hadoop'],
+        ignore_failures = True
+        )
+
     self.assertResourceCalled('Execute', 'chown -R gpadmin:gpadmin /usr/local/hawq/',
         timeout = 600
         )