feat(livy): add HA support for livy

roles/livy/server/tasks/kerberos.yml

@@ -3,46 +3,24 @@
     name: tosit.tdp.utils.kerberos
     tasks_from: install
 
-- block:
-    - ansible.builtin.import_role:
-        name: tosit.tdp.utils.kerberos
-        tasks_from: create_principal_keytab
-      vars:
-        principal: "livy/{{ ansible_fqdn }}"
-        keytab: "livy.service.keytab"
-        user: "{{ livy_user }}"
-        group: "{{ hadoop_group }}"
-        mode: "600"
-
-    - ansible.builtin.import_role:
-        name: tosit.tdp.utils.kerberos
-        tasks_from: create_principal_keytab
-      vars:
-        principal: "HTTP/{{ ansible_fqdn }}"
-        keytab: "spnego.service.keytab"
-        user: "root"
-        group: "{{ hadoop_group }}"
-        mode: "640"
+- ansible.builtin.import_role:
+    name: tosit.tdp.utils.kerberos
+    tasks_from: create_principal_keytab
+  vars:
+    principal: "livy/{{ ansible_fqdn }}"
+    keytab: "livy.service.keytab"
+    user: "{{ livy_user }}"
+    group: "{{ hadoop_group }}"
+    mode: "600"
   when: krb_create_principals_keytabs
 
-- block:
-    - ansible.builtin.import_role:
-        name: tosit.tdp.utils.kerberos
-        tasks_from: check_secure_keytab
-      vars:
-        principal: "livy/{{ ansible_fqdn }}"
-        keytab: "livy.service.keytab"
-        user: "{{ livy_user }}"
-        group: "{{ hadoop_group }}"
-        mode: "600"
-
-    - ansible.builtin.import_role:
-        name: tosit.tdp.utils.kerberos
-        tasks_from: check_secure_keytab
-      vars:
-        principal: "HTTP/{{ ansible_fqdn }}"
-        keytab: "spnego.service.keytab"
-        user: "root"
-        group: "{{ hadoop_group }}"
-        mode: "640"
+- ansible.builtin.import_role:
+    name: tosit.tdp.utils.kerberos
+    tasks_from: check_secure_keytab
+  vars:
+    principal: "livy/{{ ansible_fqdn }}"
+    keytab: "livy.service.keytab"
+    user: "{{ livy_user }}"
+    group: "{{ hadoop_group }}"
+    mode: "600"
   when: not krb_create_principals_keytabs

tdp_lib_dag/livy-spark3.yml

@@ -4,6 +4,7 @@
 
 - name: livy-spark3_kerberos_install
   depends_on:
+    - kerberos_spnego_install
     - livy-spark3_server_install
 
 - name: livy-spark3_ssl-tls_install

tdp_lib_dag/livy.yml

@@ -4,6 +4,7 @@
 
 - name: livy_kerberos_install
   depends_on:
+    - kerberos_spnego_install
     - livy_server_install
 
 - name: livy_ssl-tls_install

tdp_vars_defaults/jupyterhub/jupyterhub.yml

@@ -112,7 +112,7 @@ jupyterhub_properties:
     principal: "{{ jupyterhub_principal }}"
     prologue: source environment/bin/activate ; export CLASSPATH="$CLASSPATH:$(hadoop classpath --glob)" ; export HOME=$PWD ; chmod 700 $PWD/environment/lib64/python3.6/site-packages/certifi/cacert.pem ; cat {{ certificates_path }}/tdp_ca.crt >> $PWD/environment/lib64/python3.6/site-packages/certifi/cacert.pem ; mkdir .sparkmagic ; mv config.json .sparkmagic/
   jupyterlab:
-    livy_url: "https://{{ groups['livy_spark3_server'][0] | tosit.tdp.access_fqdn(hostvars) }}:8999"
+    livy_url: "{% if livy3_ha_address is defined %}{{ livy3_ha_address }}{% else %}https://{{ groups['livy_spark3_server'][0] | tosit.tdp.access_fqdn(hostvars) }}:8999{% endif %}"
 
 # Kerberos
 ###

tdp_vars_defaults/livy-spark3/livy-spark3.yml

@@ -47,7 +47,7 @@ livy_conf:
   livy.keystore: "{{ livy_keystore_location }}"
   livy.keystore.password: "{{ livy_keystore_password }}"
   livy.server.auth.type: kerberos
-  livy.server.auth.kerberos.principal: "HTTP/_HOST@{{ realm }}"
+  livy.server.auth.kerberos.principal: "HTTP/{% if livy3_ha_address is defined %}{{ livy3_ha_address | urlsplit('hostname') }}{% else %}_HOST{% endif %}@{{ realm }}"
   livy.server.auth.kerberos.keytab: /etc/security/keytabs/spnego.service.keytab
   livy.server.launch.kerberos.principal: "livy/_HOST@{{ realm }}"
   livy.server.launch.kerberos.keytab: /etc/security/keytabs/livy.service.keytab

tdp_vars_defaults/livy/livy.yml

@@ -47,7 +47,7 @@ livy_conf:
   livy.keystore: "{{ livy_keystore_location }}"
   livy.keystore.password: "{{ livy_keystore_password }}"
   livy.server.auth.type: kerberos
-  livy.server.auth.kerberos.principal: "HTTP/_HOST@{{ realm }}"
+  livy.server.auth.kerberos.principal: "HTTP/{% if livy_ha_address is defined %}{{ livy_ha_address | urlsplit('hostname') }}{% else %}_HOST{% endif %}@{{ realm }}"
   livy.server.auth.kerberos.keytab: /etc/security/keytabs/spnego.service.keytab
   livy.server.launch.kerberos.principal: "livy/_HOST@{{ realm }}"
   livy.server.launch.kerberos.keytab: /etc/security/keytabs/livy.service.keytab

tdp_vars_defaults/tdp-cluster/tdp-cluster.yml

@@ -113,3 +113,10 @@ observability_tdp_targets:
             scheme: https
             tls_config:
               ca_file: "{{ ca_file }}"
+
+ #############################
+#        HA Addresses       #
+#############################
+
+# livy_ha_address: "http[s]://dns_alias:port"
+# livy3_ha_address: "http[s]://dns_alias:port"

topology.ini

@@ -3,9 +3,11 @@ livy_server
 
 [livy_server:children]
 edge
+master2
 
 [livy_spark3_server:children]
 edge
+master2
 
 [kafka_broker:children]
 worker