Ansible 角色: NiFi

一个用于在 Linux 上安装 NiFi 的 Ansible 角色。默认情况下，它以一种简便的方式安装 NiFi，使得 升级 变得无痛。

要求

至少需要 Java 8。

角色变量

查看 defaults/main.yml 以了解所有变量及其指定方式。有关更多细节，可以参考 NiFi 系统管理员指南。

以下配置指定了下载（或查找现有）二进制文件（压缩包）、安装 NiFi 的路径，以及一个符号链接到指定版本的主目录。此外，还有一个集中配置目录用于存储不需更改的文件（以避免在升级期间复制）。您可以向此字典添加更多任意的键值对，这些目录将被创建。这对于需要额外目录以存放自定义 nar、驱动程序等内容时可能很有用。

nifi_config_dirs:
  binaries: /tmp
  install: /opt/nifi/releases
  home: /opt/nifi/releases/current
  external_config: /opt/nifi/config_resources

默认情况下，将创建以下目录结构：

|--opt/
  |--nifi/
    |--releases/
      |--current -> nifi-1.14.0/
      |--nifi-1.14.0/
      |--nifi-1.13.2/
    |--config_resources/
      |--archive/
      |--authorizations.xml
      |--content_repository/
      |--custom_nars/
      |--database_repository/
      |--flow.xml.gz
      |--flowfile_repository/
      |--provenance_repository/
      |--state/
      |--users.xml

任何配置文件中的键值对都可以添加到以下字典中。字典名称对应于文件名称。这些文件的当前配置选项可以在 这里 找到。

nifi_properties:
bootstrap:
nifi_env:
logback:
login_identity_providers:
state_management:
authorizers:
zookeeper:

依赖

无。

示例剧本

这些示例假设您已在配置中设置了 hash_behaviour=merge 配置。如果没有，请同时包含 defaults/main.yml 中的默认字典键/值。

基本的单节点 NiFi 实例：

- hosts: nifi_servers
  become: yes
  roles:
    - cavemandaveman.nifi

基本的使用内嵌 Zookeeper 的三节点 NiFi 集群：

- hosts: nifi_servers
  become: yes
  roles:
    - cavemandaveman.nifi
  vars:
    nifi_properties:
      # HTTP 属性必须被清除才能使 HTTPS 工作
      nifi.web.http.host: ""
      nifi.web.http.port: ""
      nifi.web.https.host: "{{ ansible_fqdn }}"
      nifi.web.https.port: 8443
      nifi.cluster.is.node: true
      nifi.cluster.node.address: "{{ ansible_fqdn }}"
      nifi.cluster.node.protocol.port: 11443
      nifi.cluster.flow.election.max.candidates: 3
      nifi.cluster.load.balance.host: "{{ ansible_fqdn }}"
      nifi.cluster.load.balance.port: 6342
      nifi.state.management.embedded.zookeeper.start: true
      nifi.zookeeper.connect.string: nifi_server1:2181,nifi_server2:2181,nifi_server3:2181
    login_identity_providers:
      /loginIdentityProviders/provider/identifier: single-user-provider
      /loginIdentityProviders/provider/class: org.apache.nifi.authentication.single.user.SingleUserLoginIdentityProvider
    authorizers_user_group_providers: 0
    authorizers:
      /authorizers/authorizer/identifier: single-user-authorizer
      /authorizers/authorizer/class: org.apache.nifi.authorization.single.user.SingleUserAuthorizer
    state_management:
      /stateManagement/cluster-provider/property[@name="Connect String"]: "{{ nifi_properties['nifi.zookeeper.connect.string'] }}"
    # 假设 nifi_server1 = 192.168.1.10, nifi_server2 = 192.168.1.11, nifi_server3 = 192.168.1.12
    # 我们让 Ansible 自动将每个主机的 myid 文件设置为节点 IP 地址的最后一位
    # 并将 zookeeper['server.X'] 键的 'X' 设置为这些数字。
    zookeeper_myid: "{{ ansible_default_ipv4.address.split('.')[-1] }}"
    zookeeper:
      server.10: nifi_server1:2888:3888
      server.11: nifi_server2:2888:3888
      server.12: nifi_server3:2888:3888

使用 LDAP 的安全单节点 NiFi 实例：

- hosts: nifi_servers
  become: yes
  roles:
    - cavemandaveman.nifi
  vars:
    nifi_properties:
      # HTTP 属性必须被清除才能使 HTTPS 工作
      nifi.web.http.host: ""
      nifi.web.http.port: ""
      nifi.web.https.host: "{{ ansible_fqdn }}"
      nifi.web.https.port: 8443
      nifi.security.keystore: /path/to/keystore.jks
      nifi.security.keystoreType: JKS
      nifi.security.keystorePasswd: keystorePassword
      nifi.security.keyPasswd: keyPassword
      nifi.security.truststore: /path/to/truststore.jks
      nifi.security.truststoreType: JKS
      nifi.security.truststorePasswd: truststorePassword
    login_identity_providers:
      /loginIdentityProviders/provider/identifier: ldap-provider
      /loginIdentityProviders/provider/class: org.apache.nifi.ldap.LdapProvider
      /loginIdentityProviders/provider/property[@name="Authentication Strategy"]: SIMPLE
      /loginIdentityProviders/provider/property[@name="Manager DN"]: cn=nifi,ou=people,dc=example,dc=com
      /loginIdentityProviders/provider/property[@name="Manager Password"]: password
      /loginIdentityProviders/provider/property[@name="Referral Strategy"]: FOLLOW
      /loginIdentityProviders/provider/property[@name="Connect Timeout"]: 10 secs
      /loginIdentityProviders/provider/property[@name="Read Timeout"]: 10 secs
      /loginIdentityProviders/provider/property[@name="Url"]: ldap://hostname:port
      /loginIdentityProviders/provider/property[@name="User Search Base"]: OU=people,DC=example,DC=com
      /loginIdentityProviders/provider/property[@name="User Search Filter"]: sAMAccountName={0}
      /loginIdentityProviders/provider/property[@name="Identity Strategy"]: USE_DN
      /login_identity_providers/provider/property[@name="Authentication Expiration"]: 12 hours
    authorizers_user_group_providers: 1
    authorizers:
      /authorizers/userGroupProvider[1]/identifier: file-user-group-provider
      /authorizers/userGroupProvider[1]/class: org.apache.nifi.authorization.FileUserGroupProvider
      /authorizers/userGroupProvider[1]/property[@name="Users File"]: "{{ nifi_config_dirs.external_config }}/users.xml"
      /authorizers/userGroupProvider[1]/property[@name="Initial User Identity 1"]: cn=John Smith,ou=people,dc=example,dc=com
      /authorizers/accessPolicyProvider/identifier: file-access-policy-provider
      /authorizers/accessPolicyProvider/class: org.apache.nifi.authorization.FileAccessPolicyProvider
      /authorizers/accessPolicyProvider/property[@name="User Group Provider"]: file-user-group-provider
      /authorizers/accessPolicyProvider/property[@name="Authorizations File"]: "{{ nifi_config_dirs.external_config }}/authorizations.xml"
      /authorizers/accessPolicyProvider/property[@name="Initial Admin Identity"]: cn=John Smith,ou=people,dc=example,dc=com
      /authorizers/authorizer/identifier: managed-authorizer
      /authorizers/authorizer/class: org.apache.nifi.authorization.StandardManagedAuthorizer
      /authorizers/authorizer/property[@name="Access Policy Provider"]: file-access-policy-provider

使用内嵌 Zookeeper 的安全三节点 NiFi 集群与 LDAP：

- hosts: nifi_servers
  become: yes
  roles:
    - cavemandaveman.nifi
  vars:
    nifi_properties:
      # HTTP 属性必须被清除才能使 HTTPS 工作
      nifi.web.http.host: ""
      nifi.web.http.port: ""
      nifi.web.https.host: "{{ ansible_fqdn }}"
      nifi.web.https.port: 8443
      nifi.security.keystore: /path/to/keystore.jks
      nifi.security.keystoreType: JKS
      nifi.security.keystorePasswd: keystorePassword
      nifi.security.keyPasswd: keyPassword
      nifi.security.truststore: /path/to/truststore.jks
      nifi.security.truststoreType: JKS
      nifi.security.truststorePasswd: truststorePassword
      nifi.cluster.protocol.is.secure: true
      nifi.cluster.is.node: true
      nifi.cluster.node.address: "{{ ansible_fqdn }}"
      nifi.cluster.node.protocol.port: 11443
      nifi.cluster.flow.election.max.candidates: 3
      nifi.cluster.load.balance.host: "{{ ansible_fqdn }}"
      nifi.cluster.load.balance.port: 6342
      nifi.state.management.embedded.zookeeper.start: true
      nifi.zookeeper.connect.string: nifi_server1:2181,nifi_server2:2181,nifi_server3:2181
    login_identity_providers:
      /loginIdentityProviders/provider/identifier: ldap-provider
      /loginIdentityProviders/provider/class: org.apache.nifi.ldap.LdapProvider
      /loginIdentityProviders/provider/property[@name="Authentication Strategy"]: SIMPLE
      /loginIdentityProviders/provider/property[@name="Manager DN"]: cn=nifi,ou=people,dc=example,dc=com
      /loginIdentityProviders/provider/property[@name="Manager Password"]: password
      /loginIdentityProviders/provider/property[@name="Referral Strategy"]: FOLLOW
      /loginIdentityProviders/provider/property[@name="Connect Timeout"]: 10 secs
      /loginIdentityProviders/provider/property[@name="Read Timeout"]: 10 secs
      /loginIdentityProviders/provider/property[@name="Url"]: ldap://hostname:port
      /loginIdentityProviders/provider/property[@name="User Search Base"]: OU=people,DC=example,DC=com
      /loginIdentityProviders/provider/property[@name="User Search Filter"]: sAMAccountName={0}
      /loginIdentityProviders/provider/property[@name="Identity Strategy"]: USE_DN
      /loginIdentityProviders/provider/property[@name="Authentication Expiration"]: 12 hours
    authorizers_user_group_providers: 1
    authorizers:
      /authorizers/userGroupProvider[1]/identifier: file-user-group-provider
      /authorizers/userGroupProvider[1]/class: org.apache.nifi.authorization.FileUserGroupProvider
      /authorizers/userGroupProvider[1]/property[@name="Users File"]: "{{ nifi_config_dirs.external_config }}/users.xml"
      /authorizers/userGroupProvider[1]/property[@name="Initial User Identity 1"]: cn=John Smith,ou=people,dc=example,dc=com
      # 在这里使用节点证书的完整 DN
      /authorizers/userGroupProvider[1]/property[@name="Initial User Identity 2"]: CN=nifi_server1.example.com, O=ExampleLLC, L=Saint Louis, ST=Missouri, C=US
      /authorizers/userGroupProvider[1]/property[@name="Initial User Identity 3"]: CN=nifi_server2.example.com, O=ExampleLLC, L=Saint Louis, ST=Missouri, C=US
      /authorizers/userGroupProvider[1]/property[@name="Initial User Identity 4"]: CN=nifi_server3.example.com, O=ExampleLLC, L=Saint Louis, ST=Missouri, C=US
      /authorizers/accessPolicyProvider/identifier: file-access-policy-provider
      /authorizers/accessPolicyProvider/class: org.apache.nifi.authorization.FileAccessPolicyProvider
      /authorizers/accessPolicyProvider/property[@name="User Group Provider"]: file-user-group-provider
      /authorizers/accessPolicyProvider/property[@name="Authorizations File"]: "{{ nifi_config_dirs.external_config }}/authorizations.xml"
      /authorizers/accessPolicyProvider/property[@name="Initial Admin Identity"]: cn=John Smith,ou=people,dc=example,dc=com
      /authorizers/accessPolicyProvider/property[@name="Node Identity 1"]: CN=nifi_server1.example.com, O=ExampleLLC, L=Saint Louis, ST=Missouri, C=US
      /authorizers/accessPolicyProvider/property[@name="Node Identity 2"]: CN=nifi_server2.example.com, O=ExampleLLC, L=Saint Louis, ST=Missouri, C=US
      /authorizers/accessPolicyProvider/property[@name="Node Identity 3"]: CN=nifi_server3.example.com, O=ExampleLLC, L=Saint Louis, ST=Missouri, C=US
      /authorizers/authorizer/identifier: managed-authorizer
      /authorizers/authorizer/class: org.apache.nifi.authorization.StandardManagedAuthorizer
      /authorizers/authorizer/property[@name="Access Policy Provider"]: file-access-policy-provider
    state_management:
      /stateManagement/cluster-provider/property[@name="Connect String"]: "{{ nifi_properties['nifi.zookeeper.connect.string'] }}"
    # 假设 nifi_server1 = 192.168.1.10, nifi_server2 = 192.168.1.11, nifi_server3 = 192.168.1.12
    # 我们让 Ansible 自动将每个主机的 myid 文件设置为节点 IP 地址的最后一位
    # 并将 zookeeper['server.X'] 键的 'X' 设置为这些数字。
    zookeeper_myid: "{{ ansible_default_ipv4.address.split('.')[-1] }}"
    zookeeper:
      server.10: nifi_server1:2888:3888
      server.11: nifi_server2:2888:3888
      server.12: nifi_server3:2888:3888

许可证

GPLv3

作者信息

这个角色由 cavemandaveman 在 2018 年创建。