CDP Administration and Security: Cloudera Manager, SDX, and Identity
CDP Administration and Security
This domain tests how a CDP deployment is managed and how access is governed: Cloudera Manager for service lifecycle, the Shared Data Experience (SDX) for security and governance, and the identity plumbing connecting them.
Control plane
Cloudera Manager deploys parcels, manages hosts and roles, and applies Data Hub templates. Runtime configuration changes usually require restarting the affected role, and client configuration deployments push updated files to gateway hosts.
SDX components
- Apache Ranger authorizes HDFS, Hive, Impala, HBase, Kafka, and other services. Policies bind resources to roles, groups, or users; deny policies override allows; column masking and row filters apply at query time.
- Apache Atlas holds metadata, classifications, and lineage. Tag-based Ranger policies depend on Atlas classifications already being present.
- Kerberos, via MIT KDC or Active Directory, authenticates users and services; principals and keytabs must exist before a service starts.
- Apache Knox provides a proxied REST gateway with SSO, so clients reach services without direct network access.
- HDFS Transparent Data Encryption uses a key management server; encrypted zones require a key and stay transparent to authorized readers.
Worked example
An analyst has a Ranger Hive SELECT policy on sales.orders, yet Impala returns Authorization failed. Reasoning: Impala also checks the HDFS URI path. Without a matching HDFS Ranger policy, or suitable POSIX ownership, on the warehouse path for orders, the read fails. The fix is path-level read access granted through a tagged or path-based policy rather than broad POSIX changes.
Traps
- Assuming Ranger policies replace filesystem permissions; both layers are evaluated.
- Granting a masked column but omitting the base SELECT policy the mask depends on.
- Expecting tag-based policies to apply before Atlas classifications propagate.
- Overlooking Kerberos keytab expiry, which appears as service-level authentication failures.