Accessing Hive Metastore (HMS) using NodePort

You can access the watsonx.data Hive Metastore (HMS) service from outside the OpenShift Container Platform cluster by exposing the HMS using a NodePort service.

Important: In watsonx.data, HMS is not exposed by default. It must be exposed using a NodePort service to facilitate connection from external applications (outside the watsonx.data namespace), such as Spark to watsonx.data. Not exposing HMS will result in Thrift connection failure and thereby failure to connect with watsonx.data.

watsonx.data on Red Hat® OpenShift®

About this task

You can connect to Hive Metastore (HMS) service from inside the cluster by using the internal service address thrift://ibm-lh-lakehouse-hive-metastore-svc.<namespace>.svc.cluster.local:9083. However to access the Hive Metastore (HMS) externally from outside the cluster, you need to expose the HMS using a over a NodePort.

Procedure

Create a NodePort service.

Update the watsonx.data instance to create a NodePort for Hive Metastore. Run the following commands:

export PROJECT_CPD_INST_OPERANDS=<INSTANCE_NAMESPACE>

oc patch wxd/lakehouse \
  --type=merge \
   -n ${PROJECT_CPD_INST_OPERANDS} \
   -p '{ "spec": { "expose_hive_metastore": true } }'

Get the NodePort value that is created. Run the following command:

oc get svc ibm-lh-lakehouse-hive-metastore-nodeport
NAME                                           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
ibm-lh-lakehouse-hive-metastore-nodeport       NodePort    172.21.40.106    <none>        9083:32519/TCP               11h

Configure the NodePort with an Ingress controller.

If you use an external infrastructure node to route external traffic into the Red Hat OpenShift cluster, the cluster might be in a private zone and you need to configure an external-facing Ingress controller to route the traffic to the OpenShift nodes.

Because Hive Metastore is externally exposed through a NodePort, the Ingress Controller also needs to expose the NodePort in order to allow traffic into the cluster.

The configuration below is only applicable with an HAProxy Ingress Controller. For more detail about configuring networking, see Understanding networking in the OpenShift documentation.
1. On the infrastructure node, open the HAProxy configuration file located at /etc/haproxy/haproxy.cfg.
2. Modify the haproxy.cfg file to include the OpenShift NodePort you want to expose:
```
frontend hms-nodeport
        bind *:<node-port>
        default_backend hms-nodeport
        mode tcp
        option tcplog
backend hms-nodeport
        balance source
        mode tcp
        server worker0 <worker-0-private-ip>:<node-port> check
        server worker1 <worker-1-private-ip>:<node-port> check
        server worker2 <worker-2-private-ip>:<node-port> check
```
3. Reload HAProxy:
```
systemctl reload haproxy
```
Update the SSL certificate SANs list with the external domain of the NodePort.

To establish a trusted SSL connection with Hive Metastore, the SSL certificate's Subject Alternative Names list (SAN) must contain the same domain that you connect with externally. For example, if you want to connect to Hive Metastore using the uri: www.my.cluster.domain.com:60000 then the SANs list must include www.my.cluster.domain.com for a successful connection.

Warning: Updating the SSL certificate SANs list is a disruptive action. It causes the watsonx.data pods, including engines performing workloads, to restart. To minimize the impact, it is recommended to wait for any long-running workloads to complete before proceeding.
1. Edit the SSL certificate.
```
oc edit cert/ibm-lh-tls-certificate -n ${PROJECT_CPD_INST_OPERANDS}
```
2. Add the external domain to the allowed dnsNames.
```
spec:
  commonName: ibm-lh-tls-secret
  dnsNames:
  - '*.zen'
  - '*.zen.svc'
  - '*.zen.svc.cluster.local'
  - '*.svc.cluster.local'
  - localhost
  - ibm-lh-presto-svc
  - <infranode-domain>
```
3. Save the file, and wait for the certificate to be READY.
```
oc get cert/ibm-lh-tls-certificate -n ${PROJECT_CPD_INST_OPERANDS}
NAME                     READY   SECRET              AGE   EXPIRATION
ibm-lh-tls-certificate   True    ibm-lh-tls-secret   22h   2033-07-23T23:33:06Z
```