Disable / Uninstall the Immuta Hadoop Plugins from CDH

Audience: System Administrators

Content Summary: This page outlines steps to effectively disable and/or uninstall the Immuta components from your CDH cluster. The disable portions of this document detail how to deactivate the Immuta components without removing the components. For a complete uninstall, follow these steps and then proceed to remove all Immuta-related settings, configuration, and any Immuta Kerberos principals from your cluster.

NameNode

Steps to Disable

The Immuta Authorization Provider must be removed from the NameNode configuration.

1. Navigate to the Cloudera Manager Overview page.
2. Click on the HDFS service.
3. Click on the Configuration tab.

4. In the search bar, enter

   dfs.namenode.authorization.provider.class
   

5. Click on the minus [-] sign that appears on the right of the entry corresponding to dfs.namenode.authorization.provider.class. This will restore to the CDH default.

6. Click the Save Changes button at the bottom of the screen.

Steps to Uninstall

To uninstall, instead of only reverting the Immuta Authorization Provider, all Immuta customized settings can be removed from the NameNode configuration.

1. Navigate to the Cloudera Manager Overview page.
2. Click on the HDFS service.
3. Click on the Configuration tab.

4. Near the bottom of the left side navigation pane, select Non-Default. This will list all settings that are not presently set to the defaults.

   Warning

   You may have non-default settings that are completely unrelated to Immuta! You may also have non-default settings that are currently related to Immuta that will need to be altered to another non-default custom setting specific to your installation. Your CDH Admins will know which settings this applies to. Do not blanket revert settings to their defaults unless you are certain the CDH defaults are appropriate for your cluster.

5. All settings under

   Cluster-wide Advanced Configuration Snippet (Safety Valve) for core-site.xml
   

   can be reverted. Click the minus [-] sign that appears on the right of the individual entries, or - if you are certain your cluster should operate on the CDH defaults - all settings can be reverted by clicking the icon to the right of HDFS (Service-Wide).

6. All settings under

   NameNode Advanced Configuration Snippet (Safety Valve) for hdfs-site.xml
   

   can be reverted. Click the minus [-] sign that appears on the right of the individual entries, or - if you are certain your cluster should operate on the CDH defaults - all settings can be reverted by clicking icon to the right of NameNode Default Group.
7. Click the Save Changes button at the bottom of the screen.

YARN

If fully uninstalling, Immuta's components need to be removed from YARN's classpath.

Steps to Uninstall

1. Navigate to the YARN service.
2. Click on the Configuration tab.

3. In the search bar, enter

   yarn.application.classpath
   

4. Click on the minus [-] sign that appears on the right of any entries that reference IMMUTA. For example, there may be records for jars such as immuta-group-mapping.jar or immuta-hadoop-filesystem.jar or similar.

5. Click the Save Changes button at the bottom of the screen.

Hive

These settings may be applied either system-wide (via core-site.xml) or to specific target systems such as Hive or Impala. Be sure to locate all setting locations.

Steps to Disable

1. Navigate to the Hive service.
2. Click on the Configuration tab.

3. In the search bar, enter

   Hive Service Advanced Configuration Snippet (Safety Valve) for core-site.xml
   

4. Click on the minus [-] sign that appears to the right of the entry corresponding to hadoop.security.group.mapping. This will restore to the CDH default.

5. Click the Save Changes button at the bottom of the screen.

Steps to Uninstall

1. Navigate to the Hive service.
2. Click on the Configuration tab.

3. Near the bottom of the left side navigation pane, select Non-Default. This will list all settings that are not presently set to the defaults.

   Warning

   You may have non-default settings that are completely unrelated to Immuta! You may also have non-default settings that are currently related to Immuta that will need to be altered to another non-default custom setting specific to your installation. Your CDH Admins will know which settings this applies to. Do not blanket revert settings to their defaults unless you are certain the CDH defaults are appropriate for your cluster.

4. All settings under

   HiveServer2 Advanced Configuration Snippet (Safety Valve) for core-site.xml
   

   can be reverted. Click the minus [-] sign that appears on the right of the individual entries, or - if you are certain your cluster should operate on the CDH defaults - all settings can be reverted by clicking the icon to the right of HiveServer2 Default Group.

5. Click the Save Changes button at the bottom of the screen.

Impala

These settings may be applied either system-wide (via core-site.xml) or to specific target systems such as Hive or Impala. Be sure to locate all setting locations.

Steps to Disable

1. Navigate to the Impala service.
2. Click on the Configuration tab.

3. In the search bar, enter

   Impala Daemon Advanced Configuration Snippet (Safety Valve) for core-site.xml
   

4. Click on the minus [-] sign that appears on the right of the entry corresponding to hadoop.security.group.mapping. This will restore to the CDH default.

5. Click the Save Changes button at the bottom of the screen.

Steps to Uninstall

1. Navigate to the Impala service.
2. Click on the Configuration tab.

3. Near the bottom of the left side navigation pane, select Non-Default. This will list all settings that are not presently set to the defaults.

   Warning

   You may have non-default settings that are completely unrelated to Immuta! You may also have non-default settings that are currently related to Immuta that will need to be altered to another non-default custom setting specific to your installation. Your CDH Admins will know which settings this applies to. Do not blanket revert settings to their defaults unless you are certain the CDH defaults are appropriate for your cluster.

4. The "immuta" proxy user from

   Impala Command Line Argument Advanced Configuration Snippet (Safety Valve)
   

   can be removed. Simply delete the "immuta=*" (and any leading or trailing ;) from the -authorized_proxy_user_config= value, leaving any other values in place. It may also be done by clicking the icon to the right of Impala (Service-Wide) if the default is appropriate.

5. All settings under

   Impala Daemon Advanced Configuration Snippet (Safety Valve) for core-site.xml
   

   can be reverted. Click the minus [-] sign that appears on the right of the individual entries, or - if you are certain your cluster should operate on the CDH defaults - all settings can be reverted by clicking the icon to the right of Impala Daemon Default Group.

6. If using Kerberos principal short names was only done in support of ImmutaGroupsMapping for use in native workspaces, that setting can also be reverted. In the search bar, enter

   load_auth_to_local_rules
   

   Simply uncheck the checkbox to the left of "Impala (Service-Wide)". 1. Click the Save Changes button at the bottom of the screen.

Spark

Most of the current Spark controls are now set through the IMMUTA service and will be removed through the subsequent step of stopping and disabling that service. These instructions are primarily for legacy Spark 1.6 installs that may still contain settings from the Spark 1.6 Configuration.

Steps to Uninstall

1. Navigate to the Spark service.
2. Click on the Configuration tab.

3. In the search bar, enter

   Spark Client Advanced Configuration Snippet (Safety Valve) for spark-conf/spark-defaults.conf
   

4. Remove any references to IMMUTA or "immuta" in the configuration options. Particularly look for the options defined in Spark 1.6 Configuration.

5. Then go back to the search bar, and enter

   Spark Client Advanced Configuration Snippet (Safety Valve) for spark-conf/spark-env.sh
   

6. Remove any references to IMMUTA or "immuta" in the environment variables. Particularly look for the environment settings defined in Spark 1.6 Configuration.

7. Click the Save Changes button at the bottom of the screen.

Sentry

If your installation leveraged the Immuta HDFS Native Workspace and ImmutaGroupsMapping, Immuta was likely configured as a Sentry admin. When uninstalling, this can be removed.

Steps to Uninstall

1. Navigate to the Sentry service.
2. Click on the Configuration tab.

3. Near the bottom of the left side navigation pane, select Non-Default. This will list all settings that are not presently set to the defaults.

   Warning

   You may have non-default settings that are completely unrelated to Immuta! You may also have non-default settings that are currently related to Immuta that will need to be altered to another non-default custom setting specific to your installation. Your CDH Admins will know which settings this applies to. Do not blanket revert settings to their defaults unless you are certain the CDH defaults are appropriate for your cluster.

4. The "immuta" user can be removed from any place specified, but particularly the

   sentry.service.admin.group
   

   should be removed. Click the minus [-] sign that appears on the right of the individual entries, or - if you are certain your cluster should operate on the CDH defaults - all settings can be reverted by clicking the icon. 1. Click the Save Changes button at the bottom of the screen.

Immuta Immuta Partition/"Vulcan" Service

Steps to Disable

1 - Stop the Immuta Partition/"Vulcan" Service

1. Navigate to the Cloudera Manager Overview page.
2. Click on the down arrow next to the IMMUTA service.
3. Click Stop.
4. Confirm that you want to stop the service.

2 - Remove the Immuta Service

1. Navigate to the Cloudera Manager Overview page.
2. Click on the down arrow next to the IMMUTA service.
3. Click Delete.
4. Confirm that you want to delete the service.

Steps to Uninstall

Complete both 1 and 2 in the previous "Disable" section.

3 - Deactivate and Remove the Immuta Parcel

1. Navigate to the Cloudera Manager Overview page.
2. Click on the package icon on the top right hand side of the page near the search bar.
3. Find the "Distributed, Activated" Immuta Parcel(s) and click the Deactivate button.

4. Click Confirm.

   Note

   If the parcel was in active use, a cluster restart is likely needed before Cloudera Manager will let you do the following steps to remove and delete these parcels.

5. Once deactivated, go back to the Immuta Parcels(s) and select the "down arrow" beside the "Activate" button, and select Remove from Hosts.

6. Click Confirm.
7. Once not distributed, go back to the Immuta Parcels(s) and select the "down arrow" beside the "Distribute" button, and select Delete.
8. Click Delete.

Restart the Cluster

To commit all previous settings, issue a restart of the CDH cluster.