Support Metron Install on existing Ambari Managed Cluster

In Metron 0.1 release, we had support for automated install of Metron on AWS and on a single node vagrant. However, most users will want to install Metron on an existing ambari managed cluster.

We need to support installation of metron based on the following assumptions/specs:

• Customer has cluster installed via Ambari. We need to come up with the cluster spec that they need to adhere to. (What services enabled, kerberos turned off, the size of the cluster, storage, memory, cpu, etc..)
• The exsisting cluster could be on-premise or in the cloud. It could be virtualized or on bare-metal. it shouldn’t matter to us.
• However, the cluster should be dedicated to run only metron workloads
• What other specs should we call out?

If the specs above are adhered to, the installation for Metron should support the following:

• Deployment script to install "Metron Core" which consists of:
  • Parser Topology
  • Enrichment Topology
  • Writer Topology
• Deployment Script to install Elastic Search cluster since Ambari doesn’t support installing Elastic.
• Deployment script to install Metron-UI which is the Kibana UI
• Deployment script to install Metron probes:
  • DPDK Probe
  • Bro cluster with bro kafka plugin
  • Snort
  • YAF
• Deployment script to install enrichment and threat intel stores…

This also provides the capability for the user to pick and choose what components they want to installed. Example: They might want core metron but not not the probes.

See attached image