AMBARI-1747. File ownership needs more consistency for those installations where root access is hard to get. (smohanty)

git-svn-id: https://svn.apache.org/repos/asf/incubator/ambari/trunk@1462555 13f79535-47bb-0310-9956-ffa450edef68

CHANGES.txt

@@ -534,6 +534,9 @@ Trunk (unreleased changes):
 
  BUG FIXES
 
+ AMBARI-1747. File ownership needs more consistency for those installations 
+ where root access is hard to get. (smohanty)
+
  AMBARI-1561. API should return nagios_alerts as a JSON, not a stringified 
  JSON. (smohanty)
 

ambari-agent/src/main/puppet/modules/hdp-ganglia/files/setupGanglia.sh

@@ -26,7 +26,7 @@ source ./gangliaLib.sh
 function usage()
 {
   cat << END_USAGE
-Usage: ${0} [-c <gmondClusterName> [-m]] [-t]
+Usage: ${0} [-c <gmondClusterName> [-m]] [-t] [-o <owner>] [-g <group>]
 
 Options:
   -c <gmondClusterName>   The name of the Ganglia Cluster whose gmond configuration we're here to generate.
@@ -36,6 +36,8 @@ Options:
 
   -t                      Whether this is a call to generate gmetad configuration (as opposed to the
                           gmond configuration that is generated without this).
+  -o <owner>              Owner
+  -g <group>              Group
 END_USAGE
 }
 
@@ -73,6 +75,8 @@ function instantiateGmondConf()
       generateGmondMasterConf ${gmondClusterName} > `getGmondMasterConfFileName ${gmondClusterName}`;
     fi
 
+    chown -R ${3}:${4} ${GANGLIA_CONF_DIR}/${gmondClusterName}
+
   else
     echo "No gmondClusterName passed in, nothing to instantiate";
   fi
@@ -83,8 +87,10 @@ function instantiateGmondConf()
 gmondClusterName=;
 isMasterGmond=0;
 configureGmetad=0;
+owner='root';
+group='root';
 
-while getopts ":c:mt" OPTION
+while getopts ":c:mto:g:" OPTION
 do
   case ${OPTION} in
     c) 
@@ -96,6 +102,12 @@ do
     t)
       configureGmetad=1;
       ;;
+    o)
+      owner=${OPTARG};
+      ;;
+    g)
+      group=${OPTARG};
+      ;;
     ?)
       usage;
       exit 1;
@@ -107,6 +119,7 @@ createDirectory ${GANGLIA_CONF_DIR};
 createDirectory ${GANGLIA_RUNTIME_DIR};
 # So rrdcached can drop its PID files in here.
 chmod a+w ${GANGLIA_RUNTIME_DIR};
+chown ${owner}:${group} ${GANGLIA_CONF_DIR};
 
 if [ -n "${gmondClusterName}" ]
 then
@@ -116,7 +129,7 @@ then
   then
     instantiateGmetadConf;
   else
-    instantiateGmondConf ${gmondClusterName} ${isMasterGmond};
+    instantiateGmondConf ${gmondClusterName} ${isMasterGmond} ${owner} ${group};
   fi
 
 elif [ "1" -eq "${configureGmetad}" ]

ambari-agent/src/main/puppet/modules/hdp-ganglia/manifests/config/generate_monitor.pp

@@ -21,16 +21,18 @@
 #TODO: these scripts called shoudl be converetd to native puppet
 define hdp-ganglia::config::generate_monitor(
   $ganglia_service,
-  $role
+  $role,
+  $owner = 'root',
+  $group = $hdp::params::user_group
 )
 {
   $shell_cmds_dir = $hdp-ganglia::params::ganglia_shell_cmds_dir
   $cmd = $ganglia_service ? {
     'gmond'  => $role ? {
-      'server' => "${shell_cmds_dir}/setupGanglia.sh -c ${name} -m",
-       default =>  "${shell_cmds_dir}/setupGanglia.sh -c ${name}"
+      'server' => "${shell_cmds_dir}/setupGanglia.sh -c ${name} -m -o ${owner} -g ${group}",
+       default =>  "${shell_cmds_dir}/setupGanglia.sh -c ${name} -o ${owner} -g ${group}"
     },
-    'gmetad' => "${shell_cmds_dir}/setupGanglia.sh -t",
+    'gmetad' => "${shell_cmds_dir}/setupGanglia.sh -t -o ${owner} -g ${group}",
      default => hdp_fail("Unexpected ganglia service: ${$ganglia_service}")	
   }
 

ambari-agent/src/main/puppet/modules/hdp-ganglia/manifests/config/generate_server.pp

@@ -21,17 +21,19 @@
 #TODO: these scripts called shoudl be converetd to native puppet
 define hdp-ganglia::config::generate_server(
   $ganglia_service,
-  $role
+  $role,
+  $owner = 'root',
+  $group = $hdp::params::user_group
 )
 {
   $shell_cmds_dir = $hdp-ganglia::params::ganglia_shell_cmds_dir
 
   $cmd = $ganglia_service ? {
     'gmond'  => $role ? {
-      'server' => "${shell_cmds_dir}/setupGanglia.sh -c ${name} -m",
-       default =>  "${shell_cmds_dir}/setupGanglia.sh -c ${name}"
+      'server' => "${shell_cmds_dir}/setupGanglia.sh -c ${name} -m -o ${owner} -g ${group}",
+       default =>  "${shell_cmds_dir}/setupGanglia.sh -c ${name} -o ${owner} -g ${group}"
     },
-    'gmetad' => "${shell_cmds_dir}/setupGanglia.sh -t",
+    'gmetad' => "${shell_cmds_dir}/setupGanglia.sh -t -o ${owner} -g ${group}",
      default => hdp_fail("Unexpected ganglia service: ${$ganglia_service}")	
   }
 

ambari-agent/src/main/puppet/modules/hdp-ganglia/manifests/monitor.pp

@@ -61,11 +61,13 @@ class hdp-ganglia::monitor(
   
     class { 'hdp-ganglia::monitor::gmond': ensure => $service_state}
 
+    class { 'hdp-ganglia::monitor::ownership': }
+
     if ($hdp::params::service_exists['hdp-ganglia::server'] != true) {
       Class['hdp-ganglia'] -> Hdp::Package['ganglia-monitor'] -> Class['hdp-ganglia::config'] -> 
-      Class['hdp-ganglia::monitor::config-gen'] -> Class['hdp-ganglia::monitor::gmond']
+      Class['hdp-ganglia::monitor::config-gen'] -> Class['hdp-ganglia::monitor::gmond'] -> Class['hdp-ganglia::monitor::ownership']
     } else {
-      Hdp::Package['ganglia-monitor'] ->  Class['hdp-ganglia::monitor::config-gen'] -> Class['hdp-ganglia::monitor::gmond']
+      Hdp::Package['ganglia-monitor'] ->  Class['hdp-ganglia::monitor::config-gen'] -> Class['hdp-ganglia::monitor::gmond'] -> Class['hdp-ganglia::monitor::ownership']
     }
   }
 }
@@ -126,3 +128,26 @@ class hdp-ganglia::monitor::gmond(
     }
   }
 }
+
+class hdp-ganglia::monitor::ownership() {
+
+  file { "${hdp-ganglia::params::ganglia_dir}/conf.d":
+    owner  => 'root',
+    group  => $hdp::params::user_group
+  }
+
+  file { "${hdp-ganglia::params::ganglia_dir}/conf.d/modgstatus.conf":
+    owner => 'root',
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-ganglia::params::ganglia_dir}/conf.d/multicpu.conf":
+    owner => 'root',
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-ganglia::params::ganglia_dir}/gmond.conf":
+    owner => 'root',
+    group => $hdp::params::user_group
+  }
+}

ambari-agent/src/main/puppet/modules/hdp-ganglia/manifests/params.pp

@@ -21,6 +21,7 @@
 class hdp-ganglia::params() inherits hdp::params
 {
   $ganglia_conf_dir = "/etc/ganglia/hdp"
+  $ganglia_dir = "/etc/ganglia"
   $ganglia_runtime_dir = "/var/run/ganglia/hdp"
 
   $ganglia_shell_cmds_dir = hdp_default("ganglia_shell_cmd_dir","/usr/libexec/hdp/ganglia")

ambari-agent/src/main/puppet/modules/hdp-ganglia/manifests/server.pp

@@ -88,10 +88,15 @@ class hdp-ganglia::server(
       ensure => 'present'
    }
 
+  file { "${hdp-ganglia::params::ganglia_dir}/gmetad.conf":
+    owner => 'root',
+    group => $hdp::params::user_group
+  }
+
   #top level does not need anchors
   Class['hdp-ganglia'] -> Class['hdp-ganglia::server::packages'] -> Class['hdp-ganglia::config'] ->
  Hdp-ganglia::Config::Generate_server<||> ->
- Class['hdp-ganglia::server::gmetad'] -> Class['hdp-ganglia::service::change_permission'] -> Class['hdp-ganglia::server::files'] -> Class['hdp-monitor-webserver']
+ Class['hdp-ganglia::server::gmetad'] -> File["${hdp-ganglia::params::ganglia_dir}/gmetad.conf"] -> Class['hdp-ganglia::service::change_permission'] -> Class['hdp-ganglia::server::files'] -> Class['hdp-monitor-webserver']
  }
 }
 

ambari-agent/src/main/puppet/modules/hdp-hadoop/manifests/init.pp

@@ -68,6 +68,11 @@ debug('##Configs generation for hdp-hadoop')
       owner => $hdp-hadoop::params::hdfs_user,
       group => $hdp::params::user_group
     }
+  } else { # Manually overriding ownership of file installed by hadoop package
+    file { "${hdp-hadoop::params::conf_dir}/hadoop-policy.xml":
+      owner => $hdp-hadoop::params::hdfs_user,
+      group => $hdp::params::user_group
+    }
   }
 
   if has_key($configuration, 'core-site') {
@@ -79,7 +84,12 @@ debug('##Configs generation for hdp-hadoop')
         owner => $hdp-hadoop::params::hdfs_user,
         group => $hdp::params::user_group
       }
+  } else { # Manually overriding ownership of file installed by hadoop package
+    file { "${hdp-hadoop::params::conf_dir}/core-site.xml":
+      owner => $hdp-hadoop::params::hdfs_user,
+      group => $hdp::params::user_group
     }
+  }
 
   if has_key($configuration, 'mapred-site') {
     configgenerator::configfile{'mapred-site': 
@@ -90,6 +100,11 @@ debug('##Configs generation for hdp-hadoop')
       owner => $hdp-hadoop::params::mapred_user,
       group => $hdp::params::user_group
     }
+  } else { # Manually overriding ownership of file installed by hadoop package
+    file { "${hdp-hadoop::params::conf_dir}/mapred-site.xml":
+      owner => $hdp-hadoop::params::mapred_user,
+      group => $hdp::params::user_group
+    }
   }
 
 
@@ -102,6 +117,11 @@ debug('##Configs generation for hdp-hadoop')
       owner => $hdp-hadoop::params::hdfs_user,
       group => $hdp::params::user_group,
     }
+  } else { # Manually overriding ownership of file installed by hadoop package
+    file { "${hdp-hadoop::params::conf_dir}/capacity-scheduler.xml":
+      owner => $hdp-hadoop::params::hdfs_user,
+      group => $hdp::params::user_group
+    }
   } 
 
 
@@ -114,6 +134,11 @@ debug('##Configs generation for hdp-hadoop')
       owner => $hdp-hadoop::params::hdfs_user,
       group => $hdp::params::user_group
     }
+  } else { # Manually overriding ownership of file installed by hadoop package
+    file { "${hdp-hadoop::params::conf_dir}/hdfs-site.xml":
+      owner => $hdp-hadoop::params::hdfs_user,
+      group => $hdp::params::user_group
+    }
   }
 
   if has_key($configuration, 'hdfs-exclude-file') {
@@ -129,6 +154,31 @@ debug('##Configs generation for hdp-hadoop')
     target => '/usr/lib/hadoop/hadoop-tools.jar',
     mode => 755,
   }
+
+  file { "${hdp-hadoop::params::conf_dir}/configuration.xsl":
+    owner => $hdp-hadoop::params::hdfs_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-hadoop::params::conf_dir}/fair-scheduler.xml":
+    owner => $hdp-hadoop::params::mapred_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-hadoop::params::conf_dir}/masters":
+    owner => $hdp-hadoop::params::hdfs_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-hadoop::params::conf_dir}/ssl-client.xml.example":
+    owner => $hdp-hadoop::params::mapred_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-hadoop::params::conf_dir}/ssl-server.xml.example":
+    owner => $hdp-hadoop::params::mapred_user,
+    group => $hdp::params::user_group
+  }
 }
 
 class hdp-hadoop(
@@ -161,7 +211,9 @@ class hdp-hadoop(
 
     hdp::directory_recursive_create { $hadoop_config_dir:
       service_state => $service_state,
-      force => true
+      force => true,
+      owner => $hdfs_user,
+      group => $hdp::params::user_group
     }
  
     hdp::user{ $hdfs_user:}
@@ -210,7 +262,7 @@ class hdp-hadoop(
       owner => $hdfs_user,
     }
 
-    Anchor['hdp-hadoop::begin'] -> Hdp-hadoop::Package<||> ->  Hdp::Directory_recursive_create[$hadoop_config_dir] ->  Hdp::User<|title == $hdfs_user or title == $mapred_user|> 
+    Anchor['hdp-hadoop::begin'] -> Hdp-hadoop::Package<||> ->  Hdp::User<|title == $hdfs_user or title == $mapred_user|>  ->  Hdp::Directory_recursive_create[$hadoop_config_dir] 
     -> Hdp-hadoop::Configfile<|tag == 'common'|> -> Anchor['hdp-hadoop::end']
     Anchor['hdp-hadoop::begin'] -> Hdp::Directory_recursive_create[$logdirprefix] -> Anchor['hdp-hadoop::end']
     Anchor['hdp-hadoop::begin'] -> Hdp::Directory_recursive_create[$piddirprefix] -> Anchor['hdp-hadoop::end']

ambari-agent/src/main/puppet/modules/hdp-hbase/manifests/init.pp

@@ -37,18 +37,32 @@ class hdp-hbase(
       modulespath => $hdp-hbase::params::conf_dir,
       filename => 'hbase-site.xml',
       module => 'hdp-hbase',
-      configuration => $configuration['hbase-site']
-      }
+      configuration => $configuration['hbase-site'],
+      owner => $hbase_user,
+      group => $hdp::params::user_group
+    }
+  } else { # Manually overriding ownership of file installed by hadoop package
+    file { "${hdp-hbase::params::conf_dir}/hbase-site.xml":
+      owner => $hbase_user,
+      group => $hdp::params::user_group
     }
+  }
 
   if has_key($configuration, 'hbase-policy') {
     configgenerator::configfile{'hbase-policy': 
       modulespath => $hdp-hbase::params::conf_dir,
       filename => 'hbase-policy.xml',
       module => 'hdp-hbase',
-      configuration => $configuration['hbase-policy']
-      }
+      configuration => $configuration['hbase-policy'],
+      owner => $hbase_user,
+      group => $hdp::params::user_group
     }
+  } else { # Manually overriding ownership of file installed by hadoop package
+    file { "${hdp-hbase::params::conf_dir}/hbase-policy.xml":
+      owner => $hbase_user,
+      group => $hdp::params::user_group
+    }
+  }
 
   anchor{'hdp-hbase::begin':}
   anchor{'hdp-hbase::end':}
@@ -71,7 +85,10 @@ class hdp-hbase(
  
     hdp::directory { $config_dir: 
       service_state => $service_state,
-      force => true
+      force => true,
+      owner => $hbase_user,
+      group => $hdp::params::user_group,
+      override_owner => true
     }
 
    hdp-hbase::configfile { ['hbase-env.sh','log4j.properties','hadoop-metrics.properties']: 

ambari-agent/src/main/puppet/modules/hdp-hcat/manifests/init.pp

@@ -57,7 +57,10 @@ class hdp-hcat(
 
     hdp::directory { $hcat_config_dir:
       service_state => $service_state,
-      force => true
+      force => true,
+      owner => $hcat_user,
+      group => $hdp::params::user_group,
+      override_owner => true
     }
 
     hdp::directory_recursive_create { $hcat_pid_dir:
@@ -85,6 +88,7 @@ class hdp-hcat(
 define hdp-hcat::configfile()
 {
   hdp::configfile { "${hdp::params::hcat_conf_dir}/${name}":
-    component => 'hcat'
+    component => 'hcat',
+    owner => $hdp::params::hcat_user
   }
 }

ambari-agent/src/main/puppet/modules/hdp-hive/manifests/init.pp

@@ -32,7 +32,7 @@ class hdp-hive(
 
   if has_key($configuration, 'hive-site') {
     configgenerator::configfile{'hive-site':
-      modulespath => $hdp-hive::params::hive_conf_dir, 
+      modulespath => $hive_config_dir, 
       filename => 'hive-site.xml',
       module => 'hdp-hive',
       configuration => $configuration['hive-site'],
@@ -40,6 +40,12 @@ class hdp-hive(
       group => $hdp::params::user_group,
       mode => '0660'
     }
+  } else {
+    file { "${hive_config_dir}/hive-site.xml":
+      owner => $hive_user,
+      group => $hdp::params::user_group,
+      mode => '0660'
+    }
   }
 
   anchor { 'hdp-hive::begin': }
@@ -67,13 +73,18 @@ class hdp-hive(
   
     hdp::directory { $hive_config_dir: 
       service_state => $service_state,
-      force => true
+      force => true,
+      owner => $hive_user,
+      group => $hdp::params::user_group,
+      override_owner => true
     }
 
     hdp-hive::configfile { ['hive-env.sh']: }
+
+    hdp-hive::ownership { 'ownership': }
   
     Anchor['hdp-hive::begin'] -> Hdp::Package['hive'] -> Hdp::User[$hive_user] ->  
-     Hdp::Directory[$hive_config_dir] -> Hdp-hive::Configfile<||> ->  Anchor['hdp-hive::end']
+     Hdp::Directory[$hive_config_dir] -> Hdp-hive::Configfile<||> -> Hdp-hive::Ownership['ownership'] -> Anchor['hdp-hive::end']
 
      if ($server == true ) {
        Hdp::Package['hive'] -> Hdp::User[$hive_user] -> Class['hdp-hive::mysql-connector'] -> Anchor['hdp-hive::end']
@@ -94,3 +105,25 @@ define hdp-hive::configfile(
     hive_server_host => $hive_server_host 
   }
 }
+
+define hdp-hive::ownership {
+  file { "${hdp-hive::params::hive_conf_dir}/hive-default.xml.template":
+    owner => $hdp-hive::params::hive_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-hive::params::hive_conf_dir}/hive-env.sh.template":
+    owner => $hdp-hive::params::hive_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-hive::params::hive_conf_dir}/hive-exec-log4j.properties.template":
+    owner => $hdp-hive::params::hive_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-hive::params::hive_conf_dir}/hive-log4j.properties.template":
+    owner => $hdp-hive::params::hive_user,
+    group => $hdp::params::user_group
+  }
+}

ambari-agent/src/main/puppet/modules/hdp-nagios/manifests/server.pp

@@ -166,13 +166,18 @@ class hdp-nagios::server(
 
     class { 'hdp-nagios::server::web_permisssions': }
 
+    file { "$nagios_config_dir/command.cfg" :
+      owner => $hdp-nagios::params::nagios_user,
+      group => $hdp-nagios::params::nagios_group
+    }
+
     class { 'hdp-nagios::server::services': ensure => $service_state}
 	
 	
 	Class['hdp-nagios::server::packages'] -> Class['hdp-nagios::server::enable_snmp']-> Hdp::Directory[$nagios_config_dir] -> Hdp::Directory[$plugins_dir] -> Hdp::Directory_recursive_create[$nagios_pid_dir] ->
 	Hdp::Directory[$nagios_obj_dir] -> Hdp::Directory_Recursive_Create[$nagios_var_dir] ->
 	Hdp::Directory_Recursive_Create[$check_result_path] -> Hdp::Directory_Recursive_Create[$nagios_rw_dir] ->
-	Class['hdp-nagios::server::config'] -> Class['hdp-nagios::server::web_permisssions'] -> Class['hdp-nagios::server::services'] -> Class['hdp-monitor-webserver']
+	Class['hdp-nagios::server::config'] -> Class['hdp-nagios::server::web_permisssions'] -> File["$nagios_config_dir/command.cfg"] -> Class['hdp-nagios::server::services'] -> Class['hdp-monitor-webserver']
 
   } else {
     hdp_fail("TODO not implemented yet: service_state = ${service_state}")
@@ -210,6 +215,14 @@ class hdp-nagios::server::web_permisssions()
     command => $cmd,
     unless => $test
   }
+
+  file { "/etc/nagios/htpasswd.users" :
+    owner => $hdp-nagios::params::nagios_user,
+    group => $hdp-nagios::params::nagios_group,
+    mode  => '0750'
+  }
+
+  Hdp::Exec[$cmd] -> File["/etc/nagios/htpasswd.users"]
 }
 
 class hdp-nagios::server::services($ensure)

ambari-agent/src/main/puppet/modules/hdp-nagios/manifests/server/config.pp

@@ -24,8 +24,8 @@ class hdp-nagios::server::config()
   $host_cfg = $hdp-nagios::params::nagios_host_cfg
   $nagios_lookup_daemon_str = $hdp::params::nagios_lookup_daemon_strs[$hdp::params::hdp_os_type]
   
-  hdp-nagios::server::configfile { 'nagios.cfg': conf_dir => $hdp-nagios::params::conf_dir }
-  hdp-nagios::server::configfile { 'resource.cfg': conf_dir => $hdp-nagios::params::conf_dir }
+  hdp-nagios::server::configfile { 'nagios.cfg': conf_dir => $hdp-nagios::params::conf_dir, group => $hdp-nagios::params::nagios_group }
+  hdp-nagios::server::configfile { 'resource.cfg': conf_dir => $hdp-nagios::params::conf_dir, group => $hdp-nagios::params::nagios_group }
   hdp-nagios::server::configfile { 'hadoop-hosts.cfg': }
   hdp-nagios::server::configfile { 'hadoop-hostgroups.cfg': }
   hdp-nagios::server::configfile { 'hadoop-servicegroups.cfg': }
@@ -54,6 +54,7 @@ class hdp-nagios::server::config()
 ###config file helper
 define hdp-nagios::server::configfile(
   $owner = $hdp-nagios::params::nagios_user,
+  $group = $hdp::params::user_group,
   $conf_dir = $hdp-nagios::params::nagios_obj_dir,
   $mode = undef
 ) 
@@ -62,6 +63,7 @@ define hdp-nagios::server::configfile(
   hdp::configfile { "${conf_dir}/${name}":
     component      => 'nagios',
     owner          => $owner,
+    group          => $group,
     mode           => $mode
   }
 

ambari-agent/src/main/puppet/modules/hdp-oozie/manifests/init.pp

@@ -33,7 +33,7 @@ class hdp-oozie(
 
   if has_key($configuration, 'oozie-site') {
     configgenerator::configfile{'oozie-site':
-      modulespath => $hdp-oozie::params::conf_dir, 
+      modulespath => $oozie_config_dir, 
       filename => 'oozie-site.xml',
       module => 'hdp-oozie',
       configuration => $configuration['oozie-site'],
@@ -41,10 +41,16 @@ class hdp-oozie(
       group => $hdp::params::user_group,
       mode => '0660'
     }
-    $oozie-site = $configuration['oozie-site']
-    $oozie_principal = $oozie-site["oozie.service.HadoopAccessorService.kerberos.principal"]
+  } else {
+    file { "${oozie_config_dir}/oozie-site.xml":
+      owner => $oozie_user,
+      group => $hdp::params::user_group,
+      mode => '0660'
+    }
   }
-  
+
+  $oozie-site = $configuration['oozie-site']
+  $oozie_principal = $oozie-site["oozie.service.HadoopAccessorService.kerberos.principal"]
 
   if ($service_state == 'uninstalled') {
     hdp::package { 'oozie-client' : 
@@ -75,13 +81,18 @@ class hdp-oozie(
      hdp::user{ $oozie_user:}
 
      hdp::directory { $oozie_config_dir: 
-      service_state => $service_state,
-      force => true
-    }
+       service_state => $service_state,
+       force => true,
+       owner => $oozie_user,
+       group => $hdp::params::user_group,
+       override_owner => true
+     }
 
      hdp-oozie::configfile { ['oozie-env.sh','oozie-log4j.properties']: }
 
-    anchor { 'hdp-oozie::begin': } -> Hdp::Package['oozie-client'] -> Hdp::User[$oozie_user] -> Hdp::Directory[$oozie_config_dir] -> Hdp-oozie::Configfile<||> -> anchor { 'hdp-oozie::end': }
+     hdp-oozie::ownership { 'ownership': }
+
+    anchor { 'hdp-oozie::begin': } -> Hdp::Package['oozie-client'] -> Hdp::User[$oozie_user] -> Hdp::Directory[$oozie_config_dir] -> Hdp-oozie::Configfile<||> -> Hdp-oozie::Ownership['ownership'] -> anchor { 'hdp-oozie::end': }
 
      if ($server == true ) { 
        Hdp::Package['oozie-server'] -> Hdp::Package['oozie-client'] -> Hdp::User[$oozie_user] ->   Class['hdp-oozie::download-ext-zip'] ->  Anchor['hdp-oozie::end']
@@ -102,3 +113,30 @@ define hdp-oozie::configfile(
     oozie_server    => $oozie_server
   }
 }
+
+define hdp-oozie::ownership {
+  file { "${hdp-oozie::params::conf_dir}/adminusers.txt":
+    owner => $hdp-oozie::params::oozie_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-oozie::params::conf_dir}/hadoop-config.xml":
+    owner => $hdp-oozie::params::oozie_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-oozie::params::conf_dir}/oozie-default.xml":
+    owner => $hdp-oozie::params::oozie_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-oozie::params::conf_dir}/action-conf":
+    owner => $hdp-oozie::params::oozie_user,
+    group => $hdp::params::user_group
+  }
+
+  file { "${hdp-oozie::params::conf_dir}/action-conf/hive.xml":
+    owner => $hdp-oozie::params::oozie_user,
+    group => $hdp::params::user_group
+  }
+}

ambari-agent/src/main/puppet/modules/hdp-pig/manifests/init.pp

@@ -49,7 +49,9 @@ class hdp-pig(
 
     hdp::directory { $pig_config_dir:
       service_state => $service_state,
-      force => true
+      force => true,
+      group => $hdp::params::user_group,
+      override_owner => true
     }
 
     hdp-pig::configfile { ['pig-env.sh','pig.properties','log4j.properties']:}

ambari-agent/src/main/puppet/modules/hdp-sqoop/manifests/init.pp

@@ -44,9 +44,19 @@ class hdp-sqoop(
       hdp-sqoop::createsymlinks { ['/usr/lib/sqoop/conf']:}
     }
 
+    hdp::directory { $conf_dir:
+      service_state => $service_state,
+      force => true,
+      owner => $sqoop_user,
+      group => $hdp::params::user_group,
+      override_owner => true
+    }
+
     hdp-sqoop::configfile { ['sqoop-env.sh']:}
 
-    anchor { 'hdp-sqoop::begin': } -> Hdp::Package['sqoop'] -> Class['hdp-sqoop::mysql-connector'] -> Hdp-sqoop::Configfile<||> -> anchor { 'hdp-sqoop::end': }
+    hdp-sqoop::ownership { 'ownership': }
+
+    anchor { 'hdp-sqoop::begin': } -> Hdp::Package['sqoop'] -> Class['hdp-sqoop::mysql-connector'] -> Hdp::Directory[$conf_dir] -> Hdp-sqoop::Configfile<||> -> Hdp-sqoop::Ownership['ownership'] -> anchor { 'hdp-sqoop::end': }
  } else {
     hdp_fail("TODO not implemented yet: service_state = ${service_state}")
   }
@@ -71,9 +81,24 @@ define hdp-sqoop::createsymlinks()
 define hdp-sqoop::configfile()
 {
   hdp::configfile { "${hdp::params::sqoop_conf_dir}/${name}":
-    component => 'sqoop'
+    component => 'sqoop',
+    owner     => $hdp::params::sqoop_user
   }
 }
 
+define hdp-sqoop::ownership {
+  file { "${hdp::params::sqoop_conf_dir}/sqoop-env-template.sh":
+    owner => $hdp::params::sqoop_user,
+    group => $hdp::params::user_group
+  }
 
+  file { "${hdp::params::sqoop_conf_dir}/sqoop-site-template.xml":
+    owner => $hdp::params::sqoop_user,
+    group => $hdp::params::user_group
+  }
 
+  file { "${hdp::params::sqoop_conf_dir}/sqoop-site.xml":
+    owner => $hdp::params::sqoop_user,
+    group => $hdp::params::user_group
+  }
+}

ambari-agent/src/main/puppet/modules/hdp-templeton/manifests/init.pp

@@ -25,12 +25,22 @@ class hdp-templeton(
 {
 # Configs generation  
 
+  $webhcat_user = $hdp-templeton::params::webhcat_user
+  $templeton_config_dir = $hdp-templeton::params::conf_dir
+
   if has_key($configuration, 'webhcat-site') {
     configgenerator::configfile{'webhcat-site': 
-      modulespath => $hdp-templeton::params::conf_dir,
+      modulespath => $templeton_config_dir,
       filename => 'webhcat-site.xml',
       module => 'hdp-templeton',
-      configuration => $configuration['webhcat-site']
+      configuration => $configuration['webhcat-site'],
+      owner => $webhcat_user,
+      group => $hdp::params::user_group
+    }
+  } else {
+    file { "${templeton_config_dir}/webhcat-site.xml":
+      owner => $webhcat_user,
+      group => $hdp::params::user_group
     }
   }
 
@@ -42,9 +52,6 @@ class hdp-templeton(
     $size = 32
   }
 
-  $webhcat_user = $hdp-templeton::params::webhcat_user
-  $templeton_config_dir = $hdp-templeton::params::conf_dir
-
   if ($service_state == 'uninstalled') {
       hdp::package { 'webhcat' :
       size => $size,
@@ -68,7 +75,10 @@ class hdp-templeton(
 
     hdp::directory { $templeton_config_dir: 
       service_state => $service_state,
-      force => true
+      force => true,
+      owner => $webhcat_user,
+      group => $hdp::params::user_group,
+      override_owner => true
     }
 
     hdp-templeton::configfile { ['webhcat-env.sh']: }

ambari-agent/src/main/puppet/modules/hdp-zookeeper/manifests/init.pp

@@ -68,7 +68,8 @@ class hdp-zookeeper(
 
      hdp::directory_recursive_create { $zk_config_dir: 
       service_state => $service_state,
-      force => true
+      force => true,
+      owner => $zk_user
      }
 
      hdp-zookeeper::configfile { ['zoo.cfg','zookeeper-env.sh','configuration.xsl','log4j.properties']: }
@@ -93,8 +94,13 @@ class hdp-zookeeper(
         }
       }
 
+     file { "${zk_config_dir}/zoo_sample.cfg":
+       owner => $zk_user,
+       group => $hdp::params::user_group
+     }
+
       Anchor['hdp-zookeeper::begin'] -> Hdp::Package['zookeeper'] -> Hdp::User[$zk_user] -> 
-        Hdp::Directory_recursive_create[$zk_config_dir] -> Hdp-zookeeper::Configfile<||> -> Anchor['hdp-zookeeper::end']
+        Hdp::Directory_recursive_create[$zk_config_dir] -> Hdp-zookeeper::Configfile<||> -> File["${zk_config_dir}/zoo_sample.cfg"] -> Anchor['hdp-zookeeper::end']
       if ($type == 'server') {
         Hdp::Directory_recursive_create[$zk_config_dir] -> Hdp-zookeeper::Configfile<||> -> Class['hdp-zookeeper::service'] -> Anchor['hdp-zookeeper::end']
       }

ambari-agent/src/main/puppet/modules/hdp/manifests/params.pp

@@ -134,6 +134,8 @@ class hdp::params()
 
   $smokeuser = hdp_default("smokeuser","ambari_qa")
   $smoke_user_group = hdp_default("smoke_user_group","users")
+
+  $sqoop_user = hdp_default("sqoop_user","sqoop")
   
   ############ Hdfs users directories
   $oozie_hdfs_user_dir = hdp_default("oozie_hdfs_user_dir", "/user/${oozie_user}")