Cloudera Docs

Two step verification in Cruise Control

Two-step verification enables you to approve Cruise Control POST requests through the review board API before execution, which helps you avoid unintended rebalancing and broker management operations.

In Cruise Control, two-step verification allows you to verify POST requests before execution. This is done through the review board API, and it helps to avoid unintended execution.

Enabling two-step verification

Starting in CDP 7.3.2 SP1 (CDP 7.3.2.10000 with CM 7.13.2.10000), you can enable two-step verification in Cloudera Manager without using a Safety Valve.

  1. In Cloudera Manager, select Clusters > Cruise Control.
  2. Click Configuration.
  3. Search for Two-Step Verification Enabled (two.step.verification.enabled).
  4. Set Two-Step Verification Enabled to true.
  5. Click Save Changes.
  6. Restart the Cruise Control service.

Submitting a POST request for review

The process of submitting a new request for review does not require extra user input. When you send a POST request to the servlet, you get a PurgatoryOrReviewResult response filtered to the submitted request. This response includes request ID, SUBMITTER_ADDRESS, SUBMISSION_TIME_MS, STATUS, and ENDPOINT_WITH_PARAMS.

Approving or discarding a POST request

You can approve or discard pending POST requests using the REVIEW endpoint. This POST endpoint takes the following arguments:

POST /kafkacruisecontrol/review?json=[true/false]&approve=[id1,id2,...]&discard=[id1,id2,...]&reason=[reason-for-review]

Each id corresponds to an individual request that is pending review. A valid request provides at least one approve or discard parameter with one or more valid review ids.

The following state transitions are supported:

  • PENDING_REVIEW to APPROVED or DISCARDED
  • APPROVED to DISCARDED or SUBMITTED

Executing an approved POST request

You can execute an approved request by sending a request to the reviewed endpoint with the approved review_id. For example, if a rebalance request was reviewed with reviewId=42, then you can execute this request by sending the following POST request:

POST /kafkacruisecontrol/rebalance?review_id=42

The response for the request will be an OptimizationResult, or a progress response in case of async endpoints.

Checking POST requests in the Review Board

You can get the details of requests in the Review Board using a GET request like the example below. If review_ids are not provided in the request, then all requests in the Review Board get listed.

GET /kafkacruisecontrol/review_board?json=[true/false]&review_ids=[id1,id2,...]