aws.reference.conf

#
# Copyright (c) 2015-2019 Cloudera, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
#
# Sample AWS Cloudera Altus Director configuration file based on the Cloudera AWS reference
# architecture:
# https://www.cloudera.com/content/dam/www/marketing/resources/solution-briefs/cloudera-enterprise-reference-architecture-for-aws-deployments.pdf.landing.html
#
# This is a template of a non-HA deployment for all services. Kerberos configurations properties
# are also provided. Refer to Cloudera Altus Director's documentation for more information.
#

#
# Cluster name
#

name: "C6-Reference-AWS"

#
# The environment and deployment name will be generated by default based on the cluster
# name. Another cluster can be bootstrapped under the same deployment by specifying the
# existing environment and deployment name along with a new cluster name. Note that when
# terminating with a configuration file, the deployment is only terminated if there are
# no other clusters under the deployment. Also, the external databases are only terminated
# if there are no other components (deployments or clusters) using the external database.
#

# environmentName: "C6-Reference-AWS Environment"
# deploymentName: "C6-Reference-AWS Deployment"

#
# Cloud provider configuration (credentials, region or zone, and more)
#

provider {
  type: aws

  #
  # Get AWS credentials from the OS environment
  # See https://docs.aws.amazon.com/general/latest/gr/aws-security-credentials.html
  #
  # If specifying the access keys directly and not through variables, make sure to enclose
  # them in double quotes.
  #
  # Leave the accessKeyId and secretAccessKey fields blank when running Altus Director on an
  # instance launched with an IAM role.
  #

  # accessKeyId: ${?AWS_ACCESS_KEY_ID}
  # secretAccessKey: ${?AWS_SECRET_ACCESS_KEY}

  #
  # ID of the Amazon AWS region to use
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html
  #

  region: region-REPLACE-ME

  #
  # Region endpoint (if you are using a region with custom endpoints, such as GovCloud)
  #

  # regionEndpoint: ec2.us-gov-west-1.amazonaws.com

  #
  # ID of the VPC subnet
  # See: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html
  #

  subnetId: subnet-REPLACE-ME

  #
  # Comma separated list of security group IDs
  # See: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
  #

  securityGroupsIds: sg-REPLACE-ME

  #
  # A prefix that Cloudera Altus Director should use when naming the instances (this is not part
  # of the hostname)
  #

  instanceNamePrefix: cloudera-director

  #
  # Specify a size for the root volume (in GB). Cloudera Altus Director will automatically expand
  # the filesystem so that you can use all the available disk space for your application
  #

  # rootVolumeSizeGB: 100 # defaults to 50 GB if not specified

  #
  # Specify the type of the EBS volume used for the root partition. Defaults to gp2
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html
  #

  # rootVolumeType: gp2 # OR standard (for EBS magnetic)

  #
  # Whether to associate a public IP address with instances or not. If this is false, instances
  # should be able to access the internet using a NAT instance if necessary.
  # See: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html
  #

  # associatePublicIpAddresses: true

  #
  # Spot Price (in USD per hour) for Spot instances
  # Can be set here and shared across instance groups, and/or overridden/set per instance group
  # See: https://aws.amazon.com/ec2/spot/pricing/
  #

  # spotPriceUSDPerHr: 0.50

  #
  # Block Duration in minutes for Spot instances
  # This value must be a multiple of 60 (60, 120, 180, 240, 300, or 360).
  # Can be set here and shared across instance groups, and/or overridden/set per instance group
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-requests.html#fixed-duration-spot-instances
  #

  # blockDurationMinutes: 120
}

#
# SSH credentials to use to connect to the instances
#

ssh {
  username: ec2-user # for RHEL image
  privateKey: privateKey-REPLACE-ME # with an absolute path to .pem file, ${HOME} may be used
}

#
# These instance properties will be applied to all instances.
#

common-instance-properties {

  #
  # Amazon Machine Image (AMI)
  #
  # Certain AMI virtualization types are incompatible with certain instance types. HVM
  # AMI types are recommended since they are compatible with most instance types.
  #
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html
  # Compatibility matrix: https://aws.amazon.com/amazon-linux-ami/instance-type-matrix/
  # Altus Director compatibility: https://www.cloudera.com/documentation/director/latest/topics/director_deployment_requirements.html
  #

  image: ami-REPLACE-ME

  # Use Auto Scaling Group (ASG)
  #
  # Altus Director can provision a group of instances in an EC2 Auto Scaling group (ASG).
  # Changing the size of the ASG must be done through Altus Director, not through the
  # AWS Management Console. By default, Altus Director will not use an ASG.
  #
  # See: http://docs.aws.amazon.com/autoscaling/ec2/userguide/AutoScalingGroup.html

  automatic: false

  #
  # Cloudera Manager Rack ID
  #
  # Each host in Cloudera Manager has a rack ID that is used to encode the datacenter topology
  # as a path
  #

  # rackId: "/default"

  #
  # Name of the IAM Role to use for this instance type
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
  #

  # iamProfileName: iam-profile-REPLACE-ME

  #
  # Tags to apply to each instance
  #

  tags {
    owner: ${?USER}
  }

  #
  # EBS Volumes
  #
  # Director can create and attach additional EBS volumes to the instance. These volumes
  # will be automatically deleted when the associated instance is terminated. These
  # properties don't apply to the root volume.
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumes.html
  #

  # ebsVolumeCount : 0
  # ebsVolumeType: st1      # Specify either st1, sc1, gp2 or io1 volume type
  # ebsVolumeSizeGiB: 500
  # ebsIops: 500            # Number of IOPS, only valid and required for io1 volume type

  #
  # EBS Volume Encryption
  #
  # Encryption can be enabled on the additional EBS volumes. An optional CMK can
  # be specified for volume encryption. Not setting a CMK means the default CMK
  # for EBS will be used. The encryption here does not apply to the root volume.
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
  #

  # enableEbsEncryption: false
  # ebsKmsKeyId: arn:aws:kms:REPLACE-ME  # full ARN of the KMS CMK

  #
  # EBS Optimized
  #
  # Specify whether to enable EBS Optimized I/O. This optimization isn't available
  # with all instance types. Some instance types are EBS Optimized by default
  # regardless of this flag. Additional usage charges may apply when using an
  # EBS-optimized instance.
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSOptimized.html
  #

  # ebsOptimized : false

  #
  # Bootstrap Scripts
  #
  # Provide scripts, that run as root, which can customize instances immediately
  # after boot and before any other Cloudera Altus Director action. Scripts run
  # in the order listed. Interpeters other than sh/bash may be used.
  #
  # Use exit code 0 to indicate success.
  # Use exit code 91 to indicate an unretryable failure.
  # Altus Director will automatically retry script execution for all other exit codes.
  #
  # Script content can be provided in a simple string, or as part of of an object
  # with an ID (for easier tracking) and an optional map of environment
  # variables to set before running the script.
  #

  bootstrapScripts: ["""#!/bin/sh

echo 'Hello World!'
exit 0

""",
    {
      id: bootstrapScript2,
      env {
        KEY1: VALUE1
        KEY2: VALUE2
      },
      content: "echo The values are $KEY1 and $KEY2"
    }
  ]

  #
  # More complex scripts can be supplied via local filesystem paths. They will
  # run after any scripts supplied in the previous bootstrapScripts section.
  #

  # bootstrapScriptsPaths: ["/tmp/test-script.sh",
  #   {
  #     id: bootstrapScriptFromPath2,
  #     env: {
  #       KEY3: VALUE3
  #     },
  #     path: "/tmp/test-script.py"
  #   }
  # ]

  #
  # Pre-terminate Scripts
  #
  # Provide scripts, that run as root, which can run cleanup steps on instances
  # immediately before termination. If an instance has already been terminated,
  # the scripts will be skipped for it. Scripts run in the order listed.
  # Interpeters other than sh/bash may be used.
  #
  # Use exit code 0 to indicate success.
  # Use exit code 91 to indicate an unretryable failure.
  # Altus Director will automatically retry script execution for all other exit codes.
  #
  # Script content can be provided in a simple string, or as part of of an object
  # with an ID (for easier tracking) and an optional map of environment
  # variables to set before running the script.
  #

  preTerminateScripts: ["""#!/bin/sh

echo 'Goodbye World!'
exit 0

""",
    {
      id: preTerminateScript2,
      env {
        KEY1: VALUE1
        KEY2: VALUE2
      },
      content: "echo The values are $KEY1 and $KEY2"
    }
  ]

  #
  # More complex scripts can be supplied via local filesystem paths. They will
  # run after any scripts supplied in the previous preTerminateScripts section.
  #

  # preTerminateScriptsPaths: ["/tmp/test-pre-terminate-script.sh",
  #   {
  #     id: preTerminateScriptFromPath2,
  #     env: {
  #       KEY3: VALUE3
  #     },
  #     path: "/tmp/test-pre-terminate-script.py"
  #   }
  # ]

  #
  # Flag indicating whether to normalize the instance. Not setting normalization here implies that
  # your bootstrap script will take care of normalization. This is an advanced configuration that
  # requires assistance from Cloudera support.
  #
  # Defaults to true
  #

  # normalizeInstance: true

  #
  # Configuration allowing for granular control over the normalization steps of an instance.
  # By default, all of these steps are on. This is an advanced configuration. None of these steps
  # will run if normalizeInstance is set to false.
  #
  # Normalization includes:
  #   prewarming the parcel directory
  #   downloading, installing, and adjusting packages
  #   minimizing swappiness
  #   increasing the maximun number of open files
  #   resizing the root partition
  #   mounting ephemeral disks
  #

  # normalizationConfig {
  #   prewarmDirectory: true
  #   installPackages: true
  #   miscellaneousServiceAdjustment: true
  #   minimizeSwappiness: true
  #   increaseMaxNumberOfOpenFiles: true
  #   resizeRootPartition: true
  #   mountAllUnmountedDisks: true
  # }

  #
  # By default Director does not do host key verification when performing SSH on an instance.
  # This can be changed for added security by setting the SSH Host Key Retrieval Type.
  #
  # NONE      : Host key fingerprints will not be stored or verified during SSH (default)
  # PROVIDER  : Retrieve the host key fingerprints from the cloud provider. This does not
  #             work for all images and will likely increase bootstrap time.
  # INSTANCE  : Retrieve the host key fingerprints upon first connection into the instance. This
  #             is less secure than the PROVIDER method since the first connection isn't guaranteed
  #             to be secure.
  # FALLBACK  : Attempt to retrieve host key fingeprint form the cloud provider first, if that
  #             fails, attempt to retrieve upon first connection into the instance.
  #

  # sshHostKeyRetrievalType: NONE

  #
  # User Data
  #
  # Director can pass opaque data or scripts to instances using the EC2 user data mechanism.
  # Director will base64-encode the user data automatically when it is provided through the
  # userDataUnencoded property. If the data is already base64-encoded, pass it through the
  # userData property instead. Only use one property or the other, not both.
  # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
  #

  # userData: "U2FtcGxlIHVzZXIgZGF0YQo="
  # userDataUnencoded: "Sample user data"
}

#
# A list of instance types to use for groups of nodes or management services. Instances
# specified here inherit from the common-instance-properties properties specified above.
#

instances {

  m42x: ${common-instance-properties} {
    type: m4.2xlarge

    #
    # The properties inherited from the provider section or common-instance-properties can
    # be overridden for each instance template.
    # These properties include:
    #

    # image: ami-REPLACE-ME
    # securityGroupsIds: sg-REPLACE-ME
    # subnetId: subnet-REPLACE-ME
    # rackId: "/default"
  }

  m44x: ${common-instance-properties} {
    type: m4.4xlarge
  }

  c34x: ${common-instance-properties} {
    type: c3.4xlarge
  }

  c38x: ${common-instance-properties} {
    type: c3.8xlarge
  }

  c44x: ${common-instance-properties} {
    type: c4.4xlarge
  }

  i2x: ${common-instance-properties} {
    type: i2.xlarge
  }

  i22x: ${common-instance-properties} {
    type: i2.2xlarge
  }

  d2x: ${common-instance-properties} {
    type: d2.xlarge
  }

  d22x: ${common-instance-properties} {
    type: d2.2xlarge
  }

  d24x: ${common-instance-properties} {
    type: d2.4xlarge
  }

  t2l: ${common-instance-properties} {   # only suitable as a gateway
    type: t2.large
  }
}

#
# Optional external database server configuration.
#
# Cloudera Altus Director can provision RDS database servers on-demand or create databases
# on existing database servers. This reference configuration does the former.
#

databaseServers {

  #
  # Provision RDS database server
  #

  rds-mysql-prod1 {

    #
    # The type of database to use. Allowed values are:
    #   - mysql
    #

    type: mysql

    #
    # The root user Cloudera Altus Director will use.
    #

    user: dbrootuser-REPLACEME

    #
    # The password for the database user.
    #

    password: dbrootpassword-REPLACEME

    #
    # The instance class of the database server.
    #

    instanceClass: dbinstanceClass-REPLACEME

    #
    # The DB subnet group for the database server.
    #

    dbSubnetGroupName: dbsubnet-REPLACE-ME

    #
    # A comma separated list of security group IDs for the database server. The Cloudera Manager
    # and cluster instances should be permitted by these groups to access the database server.
    #

    vpcSecurityGroupIds: sg-REPLACE-ME

    #
    # The amount of storage, in GB, to allocate.
    #
    allocatedStorage: 10

    #
    # The version of the database engine, e.g., MySQL.
    #

    engineVersion: 5.7.24

    #
    # Tags for the database server instance
    #

    tags {
      owner: ${?USER}
    }
  }

  #
  # Use an existing MySQL server
  #

  # existingmysql1 {
  #   type: mysql
  #   host: REPLACE-ME # with IP address of database server
  #   port: 3306
  #   user: root
  #   password: rootpassword
  # }

  #
  # Use an existing PostgresSQL server
  #

  # existingpostgres1 {
  #   type: postgresql
  #   host: REPLACE-ME # with IP address of database server
  #   port: 5432
  #   user: postgres
  #   password: rootpassword
  # }

}

#
# Configuration for Cloudera Manager. Cloudera Altus Director can use an existing Cloudera
# Manager installation, or bootstrap everything from scratch for a new cluster.
#

cloudera-manager {

  instance: ${instances.m42x} {
    #
    # The properties inherited from the provider section, common-instance-properties or
    # instance template can be overridden for the Cloudera Manager instance.
    # These properties include:
    #

    # image: ami-REPLACE-ME
    # securityGroupsIds: sg-REPLACE-ME
    # subnetId: subnet-REPLACE-ME
    # rackId: "/default"

    #
    # Additional tags for the Cloudera Manager instance
    #

    tags {
      application: "Cloudera Manager 6"
    }
  }

  #
  # Licensing configuration
  #
  # There are three mutually exclusive options for setting up Cloudera Manager's license.
  # 1. License text may be embedded in this file using the "license" field. Triple quotes (""")
  #    are recommended for including multi-line text strings.
  # 2. The "licensePath" can be used to specify the path to a file containing the license.
  # 3. The "enableEnterpriseTrial" flag indicates whether the 60-Day Cloudera Enterprise Trial
  #    should be activated when no license is present. This must not be set to true if a
  #    license is included using either "license" or "licensePath".
  #

  #
  # Embed a license for Cloudera Manager
  #

  # license: """
  #   -----BEGIN PGP SIGNED MESSAGE-----
  #   Hash: SHA1
  #
  # {
  #   "version"        : 1,
  #   "name"           : "License Owner",
  #   "uuid"           : "license id",
  #   "expirationDate" : 0,
  #   "features"       : [ "FEATURE1", "FEATURE2" ]
  # }
  # -----BEGIN PGP SIGNATURE-----
  # Version: GnuPG v1.4.11 (GNU/Linux)
  #
  # PGP SIGNATURE
  # -----END PGP SIGNATURE-----
  # """

  #
  # Include a license for Cloudera Manager from an external file
  #

  # licensePath: "/path/to/license.txt.asc"

  #
  # Activate 60-Day Cloudera Enterprise Trial
  #

  enableEnterpriseTrial: true

  #
  # Specify the billing ID.
  #
  # Altus Director will use the billing ID to report usage information to a metering service for
  # usage based billing.
  #
  # Usage reporting starts as soon as you assign a billing ID and a license to a Cloudera Manager.
  # If you remove a billing ID, Director will stop reporting to the metering service.
  #
  # When usage reporting stops, you will not have access to Cloudera Support with this deployment.
  # If you want a billing ID, please contact Cloudera. An enterprise license is required.
  #

  # billingId: billingId-REPLACE-ME

  #
  # Select the strategy for installing a JDK. Choices are:
  #
  # - AUTO (default): Altus Director installs the JDK on the Cloudera Manager instance, and
  #   Cloudera Manager installs the JDK on cluster instances
  # - DIRECTOR_MANAGED: Altus Director installs the JDK on all instances
  # - NONE: Neither Altus Director nor Cloudera Manager installs the JDK on any instances
  #

  # javaInstallationStrategy: AUTO

  #
  # Install the unlimited strength JCE policy files for higher levels of encryption.
  # Prior to setting this to true, confirm that you understand the legal ramifications
  # of using unlimited JCE policy files in your country.
  #

  # unlimitedJce: true

  #
  # Automatic TLS
  #

  #
  # Set up TLS connections automatically between Cloudera Altus Director and Cloudera Manager,
  # as well as among the cluster services. Automatic TLS includes installation of
  # unlimited strength JCE policy files (see unlimitedJce).
  #

  # tlsEnabled: true

  #
  # Pass TLS configuration properties to Cloudera Manager to refine how automatic TLS
  # is configured. All TLS configuration properties are optional and have sane defaults.
  # Additional properties are available beyond those listed here.
  #

  # tlsConfigurationProperties {
  #    subject_suffix: "O=example.com,L=Cityville,ST=CA,C=US"
  #    ca_sig_hash_algo: "SHA512"
  #    email_address: "name@example.com"
  # }

  #
  # Kerberos Credentials
  #

  #
  # An administrative Kerberos account capable of creating principals on the KDC that
  # Cloudera Manager will be using. This will typically be in the format:
  #    Principal@YOUR.KDC.REALM
  #

  # krbAdminUsername: "krbAdminUsername-REPLACE-ME"

  #
  # The password for the administrative Kerberos account.
  #

  # krbAdminPassword: "krbAdminPassword-REPLACE-ME"

  #
  # Optional database configuration for Cloudera Manager
  #
  # There are three mutually exclusive options for database usage in Cloudera Altus Director.
  # 1. With no configuration, databases in the Cloudera Manager embedded PostgreSQL database server
  #    will be used. This option is NOT supported for production use.
  # 2. Alternatively, existing external databases can be used.
  # 3. Finally, databases can be created on the fly on existing external database servers.
  #
  # Note that using an external database here necessitates using an external database
  # for the cluster services. This reference configuration is using Option 3.
  #

  #
  # (Option 2) Optional configuration for existing external databases
  #

  # databases {
  #     CLOUDERA_MANAGER {
  #         type: postgresql
  #
  #         host: db.example.com
  #         port: 123
  #
  #         user: admin
  #         password: 1231ed
  #
  #         name: scm
  #     }
  #
  #     ACTIVITYMONITOR { ... }
  #
  #     REPORTSMANAGER { ... }
  #
  #     NAVIGATOR { ... }
  #
  #     NAVIGATORMETASERVER { ... }
  # }

  #
  # (Option 3) Optional configuration for creating external databases on the fly
  #
  # When a database is created on the fly, Altus Director generates a random database name using the
  # specified database name prefix, a random username based on the specified username prefix, and a
  # random password. The password is stored by Altus Director and made available to the service that uses the database.
  # If multiple services reference the same external database server, Altus Director will create a database for each.
  #
  # MySQL limits usernames to sixteen characters. Therefore, limit usernamePrefix values for databases on MySQL to
  # seven characters; the remaining nine characters are used by the randomized suffix generated by Altus Director.
  #
  # Note that the databaseServerName must correspond to an external database server named above, which
  # can be the provisioned RDS instance or another existing database server.
  #

  databaseTemplates {
    CLOUDERA_MANAGER {
      name: scmt
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: scm
      usernamePrefix: scmu
    }

    ACTIVITYMONITOR {
      name: amont
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: amon
      usernamePrefix: amonu
    }

    REPORTSMANAGER {
      name: rmant
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: rman
      usernamePrefix: rmanu
    }

    NAVIGATOR {
      name: navt
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: nav
      usernamePrefix: navu
    }

    NAVIGATORMETASERVER {
      name: navmst
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: navms
      usernamePrefix: navmsu
    }
  }

  #
  # Configuration to override Cloudera Manager package repositories. These are
  # optional, and default to the Cloudera Enterprise release corresponding to
  # the Altus Director version.
  #

  # repository: "https://archive.cloudera.com/cm6/6.3/redhat7/yum/"
  # repositoryKeyUrl: "https://archive.cloudera.com/cm6/6.3/redhat7/yum/RPM-GPG-KEY-cloudera"

  # OR use an existing Cloudera Manager installation

  # hostname: "192.168.33.10"
  # username: REPLACE-ME # default is admin
  # password: REPLACE-ME # default is admin

  #
  # Optional configuration for Cloudera Manager and its management services
  #
  # Configuration properties for CLOUDERA_MANAGER are documented at
  # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_cmserver.html
  #
  # Configuration properties for the Cloudera Management services are documented at
  # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_mgmtservice.html
  #
  # Configuration properties for Hosts are documented at
  # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_host.html
  #

  configs {

    #
    # CLOUDERA_MANAGER corresponds to the Cloudera Manager Server configuration options
    #

    CLOUDERA_MANAGER {
      # enable_api_debug: true
      custom_banner_html: "Managed by Cloudera Altus Director"

      #
      # Kerberos Configurations
      #

      #
      # The type of KDC Cloudera Manager will be using. Valid values are "MIT KDC"
      # and "Active Directory"
      #

      # KDC_TYPE: "Active Directory"

      #
      # The KDC host name or IP address.
      #

      # KDC_HOST: "KDC_HOST-REPLACE-ME"

      #
      # The security realm that your KDC uses. This will be of the format of a fully
      # qualified domain name:
      #    YOUR.KDC.REALM
      #

      # SECURITY_REALM: "SECURITY_REALM-REPLACE-ME"

      #
      # The Active Directory KDC domain. Only applicable to Active Directory KDCs. This
      # will be in the format of an X.500 Directory Specification:
      #    DC=domain,DC=example,DC=com
      #

      # AD_KDC_DOMAIN: "AD_KDC_DOMAIN-REPLACE-ME"

      #
      # Allow Cloudera Manager to deploy Kerberos configurations to hosts. This should
      # be set to true unless you have an alternate mechanism to generate or retrieve the
      # Kerberos configuration on your Cloudera Manager node instances.
      #

      # KRB_MANAGE_KRB5_CONF: true

      #
      # The encryption types your KDC supports. Some of those listed below will require the
      # unlimited strength JCE policy files.
      #

      # KRB_ENC_TYPES: "aes256-cts aes128-cts des3-hmac-sha1 arcfour-hmac des-hmac-sha1 des-cbc-md5 des-cbc-crc"

      #
      # There are many more optional Kerberos configuration options available to Cloudera Manager.
      # Please refer to the Kerberos section of Cloudera Enterprise documentation for more details.
      #

      #
      # Workload Analytics
      #

      #
      # The following config options are necessary to enable Workload Analytics. Additionally, an external
      # Altus Account must be added via the external accounts section, which should be referenced by the
      # telemetry_altus_account configuration option.
      #

      # telemetry_master: true
      # telemetry_wa: true
      # telemetry_collect_job_logs: true
      # telemetry_altus_account: AltusAccount

    }

    #
    # CLOUDERA_MANAGEMENT_SERVICE corresponds to the Service-Wide configuration options
    #

    # CLOUDERA_MANAGEMENT_SERVICE {
    #  enable_alerts : false
    #  enable_config_alerts : false
    # }
    #
    # SERVICEMONITOR { ... }
    #
    # ACTIVITYMONITOR { ... }
    #
    # HOSTMONITOR { ... }
    #
    # REPORTSMANAGER { ... }
    #
    # EVENTSERVER { ... }
    #
    # ALERTPUBLISHER { ... }
    #
    # NAVIGATOR { ... }
    #
    # NAVIGATORMETASERVER { ... }
    #
    # # Configuration properties for all hosts
    # HOSTS { ... }
  }

  #
  # Deployment Post-create Scripts
  #
  # Provide scripts, that run as root, which can customize the Cloudera Manager
  # instance after the deployment has been created. Scripts run in the order
  # listed. Interpeters other than sh/bash may be used.
  #
  # Use exit code 0 to indicate success.
  # Use exit code 91 to indicate an unretryable failure.
  # Altus Director will automatically retry script execution for all other exit codes.
  #
  # Deployment post-creation scripts have access to the following environment
  # variables:
  #
  #    DEPLOYMENT_HOST_PORT
  #    ENVIRONMENT_NAME
  #    DEPLOYMENT_NAME
  #    CM_USERNAME
  #    CM_PASSWORD
  #
  # Script content can be provided in a simple string, or as part of of an object
  # with an ID (for easier tracking) and an optional map of additional environment
  # variables to set before running the script. Environment variables set here
  # override the values of default ones above.
  #

  postCreateScripts: ["""#!/bin/sh

echo 'Hello World!'
exit 0
""",
    {
      id: depPostCreateScript2,
      env {
        KEY1: VALUE1
        KEY2: VALUE2
      },
      content: "echo The values are $KEY1 and $KEY2"
    },
    """#!/usr/bin/python

print 'Hello again!'
"""]

  #
  # More complex scripts can be supplied via local filesystem paths. They will
  # run after any scripts supplied in the previous postCreateScripts section.
  # postCreateScriptsPaths: ["/tmp/test-script.sh",
  #   {
  #     id: postCreateScriptFromPath2,
  #     env: {
  #       KEY3: VALUE3
  #     },
  #     path: "/tmp/test-script.py"
  #   }
  # ]
  #

  #
  # Optional custom service descriptors for external parcels
  #

  # csds: [
  #   "https://archive.cloudera.com/exampleProduct/csd/example-csd.jar"
  # ]
  #

  #
  # External accounts
  #

  # Any external accounts that should be set up within Cloudera Manager. These will allow some
  # cluster services to utilize cloud functionality, such as object stores.
  #
  # Note: CM/CDH 5.10 or higher is required for this feature. At the moment, only AWS external
  # accounts are supported.
  #

  # externalAccounts {
  #
  #     #
  #     # External account that uses AWS Access Key Authentication. This type of authentication
  #     # will require adding the AWS_S3 service.
  #     #
  #
  #     AWSAccount1 {
  #         type: AWS_ACCESS_KEY_AUTH
  #         configs {
  #             aws_access_key: REPLACE-ME
  #             aws_secret_key: REPLACE-ME
  #
  #             #
  #             # S3 Guard (added in CM/CDH 5.11) can be enabled to guarantee a consistent view of data stored
  #             # in Amazon S3 by storing additional metadata in a table residing in an Amazon DynamoDB instances.
  #             # See https://www.cloudera.com/documentation/enterprise/latest/topics/cm_s3guard.html for more
  #             # details and additional S3 Guard configuration properties.
  #             #
  #
  #             # s3guard_enable: false
  #             # s3guard_region: REPLACE-ME
  #             # s3guard_table_name: s3guard-metadata
  #             # s3guard_table_auto_create: false
  #         }
  #     }
  #
  #     #
  #     # External account that uses IAM Role Authentication. This type of authentication doesn't
  #     # require adding the AWS_S3 service unless it has S3 guard enabled.
  #     #
  #
  #     AWSAccount2 {
  #         type: AWS_IAM_ROLES_AUTH
  #     }
  #
  #     #
  #     # For Workload Analytics, an Altus account is necessary. Additionally, it must be referenced in the
  #     # Cloudera Manager configuration section as specified above.
  #     #
  #
  #     AltusAccount {
  #         type: ALTUS_ACCESS_KEY_AUTH
  #         configs {
  #             access_key_id: REPLACE-ME
  #             private_key: REPLACE-ME
  #         }
  #     }
  # }
}

#
# Cluster description
#

cluster {

  # The table of products and their versions that need to be installed. Each
  # product must have a corresponding parcel in the parcelRepositories
  # configured in this section. The specified version for a product will be
  # used to find a suitable parcel. Specifying a version that is satisfied by
  # more than one parcel among those available will result in a configuration
  # error. Specify more granular versions to avoid conflicts.

  products {
    CDH: 6
    # EXAMPLEPRODUCT: 1
  }

  #
  # Optional override of CDH parcel repositories
  #
  # This defaults to the Cloudera Enterprise release corresponding to the Altus
  # Director version.
  #

  # parcelRepositories: ["https://archive.cloudera.com/cdh6/6.3/parcels/"]

  #
  # Services to include in the cluster
  #
  # NOTE: On CM 5.9+ Sentry and Kafka 2.0 can't coexist in the same cluster.
  #       If this is needed, use CM 5.8 repository and parcels, or use Kafka
  #       2.1 or higher.
  #

  services: [
    HDFS,
    YARN,
    ZOOKEEPER,
    HBASE,
    HIVE,
    HUE,
    OOZIE,
    SPARK_ON_YARN,
    KAFKA,
    SOLR,
    FLUME,
    IMPALA,
    SQOOP_CLIENT,
    KS_INDEXER,
    # SENTRY,    # Sentry requires Kerberos to be enabled
    KUDU,
    # AWS_S3     # Requires Sentry and Kerberos (on default configuraitons)
  ]

  #
  # Optional custom service configurations
  #
  # Configuration keys containing special characters (e.g., '.', ':') must be enclosed in double
  # quotes.
  #
  # Configuration properties for CDH roles and services are documented at
  # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_cdh620.html
  #

  #
  # configs {
  #     AWS_S3 {
  #       cloud_account: AWSAccount1
  #     }
  #
  #     HDFS {
  #       dfs_block_size: 134217728
  #     }
  #
  #     MAPREDUCE {
  #       mapred_system_dir: /user/home
  #       mr_user_to_impersonate: mapred1
  #     }
  #
  #     KAFKA {
  #       "num.partitions": 3
  #     }
  # }


  #
  # Optional database configuration for Cluster Services
  #
  # As mentioned in the cloudera-manager section, the three mutually exclusive options for database
  # usage are (1) No configuration which uses databases in the Cloudera Manager embedded PostgreSQL
  # database server; (2) Use existing external databases; or (3) Create databases on an existing
  # external database server.
  #

  #
  # (Option 2) Optional configuration for existing external databases for services
  #

  # databases {
  #     HIVE {
  #         type: postgresql
  #         host: db.example.com
  #         port: 123
  #         user: hive
  #         password: pass
  #         name: hive_db
  #     },
  #
  #     HUE {
  #         type: postgresql
  #         host: db.example.com
  #         port: 123
  #         user: hue
  #         password: pass
  #         name: hue_db
  #     },
  #
  #     OOZIE {
  #         type: postgresql
  #         host: db.example.com
  #         port: 123
  #         user: oozie
  #         password: pass
  #         name: oozie_db
  #     },
  #
  #     # Sentry requires Kerberos
  #     SENTRY {
  #         type: postgresql
  #         host: db.example.com
  #         port: 123
  #         user: sentry
  #         password: pass
  #         name: sentry_db
  #     },
  # }

  #
  # (Option 3) Optional configuration for creating external databases on the fly for services
  #

  databaseTemplates: {
    HIVE {
      name: hivet
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: hive
      usernamePrefix: hiveu
    },

    HUE {
      name: huet
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: hue
      usernamePrefix: hueu
    },

    OOZIE {
      name: ooziet
      databaseServerName: rds-mysql-prod1
      databaseNamePrefix: oozie
      usernamePrefix: oozieu
    },

    #
    # # Sentry requires Kerberos
    # SENTRY {
    #     name: sentryt
    #     databaseServerName: rds-mysql-prod1
    #     databaseNamePrefix: sentry
    #     usernamePrefix: sentryu
    # }
    #
  }

  #
  # Instance group configurations
  #

  #
  # Given the number of services being deployed in this sample, in order to not overload
  # a single instance, the roles for the masters have been split between two instances
  # (masters-1 and masters-2). Alternatively, all the master roles can be placed in a single
  # instance if fewer services are being deployed or if the instance type is large enough
  # to handle all roles.
  #

  masters-1 {
    count: 1

    instance: ${instances.i22x} {

      #
      # The properties inherited from the provider section or common-instance-properties or
      # instance template can be overridden for each instance group.
      # These properties include:
      #

      # image: ami-REPLACE-ME
      # automatic: false
      # securityGroupsIds: sg-REPLACE-ME
      # subnetId: subnet-REPLACE-ME
      # rackId: "/default"

      tags {
        group: master-1
      }
    }

    roles {
      HDFS: [NAMENODE]
      YARN: [RESOURCEMANAGER]
      ZOOKEEPER: [SERVER]
      HBASE: [MASTER]
      HIVE: [HIVESERVER2]
      HUE: [HUE_SERVER]
      OOZIE: [OOZIE_SERVER]
      SPARK_ON_YARN: [SPARK_YARN_HISTORY_SERVER]
      KAFKA: [KAFKA_BROKER, KAFKA_MIRROR_MAKER]
      KUDU: [KUDU_MASTER]
      IMPALA: [CATALOGSERVER]
      KS_INDEXER: [HBASE_INDEXER]
      # SENTRY: [SENTRY_SERVER]   # Sentry requires Kerberos
    }

    #
    # Optional custom role configurations
    #
    # Configuration keys containing special characters (e.g., '.', ':') must be enclosed in double
    # quotes.
    #
    # Configuration properties for CDH roles and services are documented at
    # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_cdh620.html
    #

    configs {
      #   HDFS {
      #      NAMENODE {
      #        dfs_name_dir_list: /data/nn
      #        namenode_port: 1234
      #      }
      #   }
      #   KAFKA {
      #      KAFKA_BROKER {
      #        broker_max_heap_size: 512
      #        "log.dirs": /data0/kafka/data
      #      }
      #      KAFKA_MIRROR_MAKER {
      #        "source.bootstrap.servers": "sourcebroker1:9092"
      #        "bootstrap.servers": "destinationbroker1:9092"
      #        whitelist: mytopic1
      #      }
      #   }

      KUDU {
        KUDU_MASTER {
          # The master rarely performs IO. If fs_data_dirs is unset, it will
          # use the same directory as fs_wal_dir
          fs_wal_dir: "/data0/kudu/masterwal"
          fs_data_dirs: "/data1/kudu/master"
        }
      }
    }
  }

  masters-2 {
    count: 1

    instance: ${instances.i22x} {
      tags {
        group: master-2
      }
    }

    roles {
      HDFS: [SECONDARYNAMENODE]
      YARN: [JOBHISTORY]
      HBASE: [HBASETHRIFTSERVER]
      HIVE: [HIVEMETASTORE]
      IMPALA: [STATESTORE]
    }
  }

  workers {
    count: 9
    #
    # Minimum number of instances required for this instance group.
    # Altus Director will fail bootstrap of a cluster if minCount number of instances are not
    # available in this cloud environment.
    # If minCount is not specified then minCount is set to count.
    #
    minCount: 5

    instance: ${instances.d22x} {

      #
      # Put all cluster nodes in a placement group for improved network performance
      # Note: this only works for a limited set of instances
      # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html
      #

      # placementGroup: REPLACE-ME

      tags {
        group: worker
      }
    }

    roles {
      HDFS: [DATANODE]
      YARN: [NODEMANAGER]
      HBASE: [REGIONSERVER]
      SOLR: [SOLR_SERVER]
      IMPALA: [IMPALAD]
      KUDU: [KUDU_TSERVER]
    }

    #
    # Optional custom role configurations
    #
    # Configuration keys containing special characters (e.g., '.', ':') must be enclosed in double
    # quotes.
    #
    # Configuration properties for CDH services and roles are documented at
    # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_cdh620.html
    #

    configs {
      #   HDFS {
      #     DATANODE {
      #        dfs_data_dir_list: /data/dn
      #      }
      #   }
      #   HBASE {
      #     REGIONSERVER {
      #       hbase_regionserver_java_heapsize: 4000000000
      #     }
      #   }
      KUDU {
        KUDU_TSERVER {
          # Set fs_wal_dir to an SSD drive (if exists) for better performance.
          # Set fs_data_dirs to a comma-separated string containing all remaining
          # disk drives, solid state or otherwise.
          # If there are multiple drives in the machine, it's best to ensure that
          # the WAL directory is not located on the same disk as a tserver data
          # directory.
          fs_wal_dir: "/data0/kudu/tabletwal"
          fs_data_dirs: "/data1/kudu/tablet"
        }
      }
    }
  }

  #
  # Spot instance group configuration
  # See: https://www.cloudera.com/documentation/director/latest/topics/director_aws_using_spot_instances.html
  #

  # workers-spot {
  #   count: 3
  #   #
  #   # Minimum number of instances required for this instance group.
  #   # Altus Director will fail bootstrap of a cluster if minCount number of instances are not
  #   # available in this cloud environment.
  #   #
  #   # For a group using Spot instances, minCount should always be 0.
  #   #
  #
  #   minCount: 0
  #
  #   instance: ${instances.c44x} {
  #
  #     #
  #     # Put all cluster nodes in a placement group for improved network performance
  #     # Note: this only works for a limited set of instances
  #     # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html
  #     #
  #
  #     # placementGroup: REPLACE-ME
  #
  #     #
  #     # Set a different SSH username for instances in this group
  #     #
  #
  #     # sshUsername: centos # May vary by image
  #
  #     useSpotInstances: true
  #
  #     # spotPriceUSDPerHr: 0.50 # Can be set/overridden per instance group
  #
  #     tags {
  #       group: worker-spot
  #     }
  #   }
  #
  #   # Only stateless roles can be used with Spot instances
  #   roles {
  #     YARN: [NODEMANAGER]
  #   }
  #
  #   #
  #   # Optional custom role configurations
  #   #
  #   # Configuration keys containing special characters (e.g., '.', ':') must be enclosed in double
  #   # quotes.
  #   #
  #   # Configuration properties for CDH roles and services are documented at
  #   # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_cdh620.html
  #   #
  #
  #   # configs {
  #   # }
  # }

  gateways {
    count: 1

    instance: ${instances.t2l} {
      tags {
        group: gateway
      }
    }

    roles {
      HDFS: [GATEWAY]
      YARN: [GATEWAY]
      HBASE: [GATEWAY]
      HIVE: [GATEWAY]
      SPARK_ON_YARN: [GATEWAY]
      KAFKA: [GATEWAY]
      SOLR: [GATEWAY]
      FLUME: [AGENT]
      SQOOP_CLIENT: [GATEWAY]
    }

    #
    # Optional custom role configurations
    #
    # Configuration keys containing special characters (e.g., '.', ':') must be enclosed in double
    # quotes.
    #
    # Configuration properties for CDH roles and services are documented at
    # https://www.cloudera.com/documentation/enterprise/6/properties/6.3/topics/cm_props_cdh620.html
    #

    # configs {
    #   HIVE {
    #     GATEWAY {
    #       hive_metastore_timeout: 3000
    #       client_config_root_dir: /etc/hive
    #     }
    #   }
    # }
  }

  #
  # Cluster Instance-level Post-create Scripts
  #
  # Provide scripts, that run as root, which can customize each cluster instance
  # after the cluster has been created. Scripts run on each cluster instance in
  # the order listed, before those listed under postCreateScripts and
  # postCreateScriptsPaths. Interpeters other than sh/bash may be used.
  #
  # Use exit code 0 to indicate success.
  # Use exit code 91 to indicate an unretryable failure.
  # Altus Director will automatically retry script execution for all other exit codes.
  #
  # Cluster instance-level post-creation scripts have access to the following
  # environment variables:
  #
  #    DEPLOYMENT_HOST_PORT
  #    ENVIRONMENT_NAME
  #    DEPLOYMENT_NAME
  #    CLUSTER_NAME
  #    CM_USERNAME
  #    CM_PASSWORD
  #
  # Script content can be provided in a simple string, or as part of of an object
  # with an ID (for easier tracking) and an optional map of additional environment
  # variables to set before running the script. Environment variables set here
  # override the values of default ones above.
  #

  instancePostCreateScripts: ["""#!/bin/sh

echo 'Hello World!'
exit 0
""",
    {
      id: cluInstancePostCreateScript2,
      env {
        KEY1: VALUE1
        KEY2: VALUE2
      },
      content: "echo The values are $KEY1 and $KEY2"
    },
    """#!/usr/bin/python

print 'Hello again!'
"""]

  #
  # More complex scripts can be supplied via local filesystem paths. They will
  # run after any scripts supplied in the previous instancePostCreateScripts section.
  #

  # instancePostCreateScriptsPaths: ["/tmp/test-script.sh",
  #   {
  #     id: instancePostCreateScriptFromPath2,
  #     env: {
  #       KEY3: VALUE3
  #     },
  #     path: "/tmp/test-script.py"
  #   }
  # ]

  #
  # Cluster Post-create Scripts
  #
  # Provide scripts, that run as root, which can customize the cluster after it
  # has been created. Scripts run only once, at a cluster level, on an arbitrary
  # cluster instance after those listed under instancePostCreateScripts and
  # instancePostCreateScriptsPaths. Interpeters other than sh/bash may be used.
  #
  # Use exit code 0 to indicate success.
  # Use exit code 91 to indicate an unretryable failure.
  # Altus Director will automatically retry script execution for all other exit codes.
  #
  # Cluster post-creation scripts have access to the following environment
  # variables:
  #
  #    DEPLOYMENT_HOST_PORT
  #    ENVIRONMENT_NAME
  #    DEPLOYMENT_NAME
  #    CLUSTER_NAME
  #    CM_USERNAME
  #    CM_PASSWORD
  #
  # Script content can be provided in a simple string, or as part of of an object
  # with an ID (for easier tracking) and an optional map of additional environment
  # variables to set before running the script. Environment variables set here
  # override the values of default ones above.
  #
  postCreateScripts: ["""#!/bin/sh

echo 'Hello World!'
exit 0
""",
    {
      id: cluPostCreateScript2,
      env {
        KEY1: VALUE1
        KEY2: VALUE2
      },
      content: "echo The values are $KEY1 and $KEY2"
    },
    """#!/usr/bin/python

print 'Hello again!'
"""]

  #
  # More complex scripts can be supplied via local filesystem paths. They will
  # run after any scripts supplied in the previous postCreateScripts section.
  #

  # postCreateScriptsPaths: ["/tmp/test-script.sh",
  #   {
  #     id: postCreateScriptFromPath2,
  #     env: {
  #       KEY3: VALUE3
  #     },
  #     path: "/tmp/test-script.py"
  #   }
  # ]

  #
  # Cluster Pre-terminate Scripts
  #
  # Provide scripts, that run as root, which can operate on the cluster before it
  # is terminated. Scripts run only once, at a cluster level, on an arbitrary
  # cluster instance. Interpeters other than sh/bash may be used.
  #
  # Use exit code 0 to indicate success.
  # Use exit code 91 to indicate an unretryable failure.
  # Altus Director will automatically retry script execution for all other exit codes.
  #
  # Cluster post-creation scripts have access to the following environment
  # variables:
  #
  #    DEPLOYMENT_HOST_PORT
  #    ENVIRONMENT_NAME
  #    DEPLOYMENT_NAME
  #    CLUSTER_NAME
  #    CM_USERNAME
  #    CM_PASSWORD
  #
  # Script content can be provided in a simple string, or as part of of an object
  # with an ID (for easier tracking) and an optional map of additional environment
  # variables to set before running the script. Environment variables set here
  # override the values of default ones above.
  #
  preTerminateScripts: ["""#!/bin/sh

echo 'Goodbye World!'
exit 0
""",
    {
      id: cluPreTerminateScript2,
      env {
        KEY1: VALUE1
        KEY2: VALUE2
      },
      content: "echo The values are $KEY1 and $KEY2"
    },
    """#!/usr/bin/python

print 'Goodbye again!'
"""]

  #
  # More complex scripts can be supplied via local filesystem paths. They will
  # run after any scripts supplied in the previous preTerminateScripts section.
  #

  # preTerminateScriptsPaths: ["/tmp/test-script.sh",
  #   {
  #     id: preTerminateScriptFromPath2,
  #     env: {
  #       KEY3: VALUE3
  #     },
  #     path: "/tmp/test-script.py"
  #   }
  # ]

  #
  # Optional Administration Settings
  #
  # Administration settings configure Director's interaction with the cluster.
  #

  administrationSettings {
    #
    # If enabled, Director will attempt to automatically repair
    # clusters whose instances have been terminated in the cloud provider.
    #

    # autoRepairEnabled: false

    #
    # Cooldown period between autorepair passes.
    #

    # autoRepairCooldownPeriodInSeconds: 1800
  }
}