[
    {
        "desc": "Allows the oozie superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "Oozie Proxy User Groups",
        "name": "hadoop_kms_proxyuser_oozie_groups",
        "value": "*"
    },
    {
        "desc": "The health test thresholds of the number of file descriptors used. Specified as a percentage of file descriptor limit.",
        "display_name": "File Descriptor Monitoring Thresholds",
        "name": "kms_fd_thresholds",
        "value": "{\"critical\":\"70.0\",\"warning\":\"50.0\"}"
    },
    {
        "desc": "Allows the mapred superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "Mapred Proxy User Groups",
        "name": "hadoop_kms_proxyuser_mapred_groups",
        "value": "*"
    },
    {
        "desc": "Weight for the read I/O requests issued by this role. The greater the weight, the higher the priority of the requests when the host experiences I/O contention. Must be between 100 and 1000. Defaults to 1000 for processes not managed by Cloudera Manager.",
        "display_name": "Cgroup I/O Weight",
        "name": "rm_io_weight",
        "value": "500"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the mapred user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "Mapred Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_mapred_hosts",
        "value": "*"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the httpfs user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "HttpFS Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_httpfs_hosts",
        "value": "*"
    },
    {
        "desc": "Maximum number of threads used to handle KMS requests.",
        "display_name": "KMS Max Threads",
        "name": "kms_max_threads",
        "value": "250"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the oozie user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "Oozie Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_oozie_hosts",
        "value": "*"
    },
    {
        "desc": "When set, Cloudera Manager will send alerts when this entity's configuration changes.",
        "display_name": "Enable Configuration Change Alerts",
        "name": "enable_config_alerts",
        "value": "false"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the yarn user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "YARN Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_yarn_hosts",
        "value": "*"
    },
    {
        "desc": "Enables the health test that the Key Management Server's process state is consistent with the role configuration",
        "display_name": "Key Management Server Process Health Test",
        "name": "kms_scm_health_enabled",
        "value": "true"
    },
    {
        "desc": "When set, this role's process is automatically (and transparently) restarted in the event of an unexpected failure.",
        "display_name": "Automatically Restart Process",
        "name": "process_auto_restart",
        "value": "false"
    },
    {
        "desc": "The password for the Key Management Server JKS keystore file.",
        "display_name": "Key Management Server TLS/SSL Server JKS Keystore File Password",
        "name": "ssl_server_keystore_password",
        "value": ""
    },
    {
        "desc": "Allows the hive superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "Hive Proxy User Groups",
        "name": "hadoop_kms_proxyuser_hive_groups",
        "value": "*"
    },
    {
        "desc": "Soft memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process if and only if the host is facing memory pressure. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 B to specify no limit. By default processes not managed by Cloudera Manager will have no limit.",
        "display_name": "Cgroup Memory Soft Limit",
        "name": "rm_memory_soft_limit",
        "value": "-1"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the HTTP user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "HTTP Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_HTTP_hosts",
        "value": "*"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the hdfs user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "HDFS Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_hdfs_hosts",
        "value": "*"
    },
    {
        "desc": "Allows the hdfs superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "HDFS Proxy User Groups",
        "name": "hadoop_kms_proxyuser_hdfs_groups",
        "value": "*"
    },
    {
        "desc": "The health test thresholds on the swap memory usage of the process.",
        "display_name": "Process Swap Memory Thresholds",
        "name": "process_swap_memory_thresholds",
        "value": "{\"critical\":\"never\",\"warning\":\"any\"}"
    },
    {
        "desc": "For advanced use only, a string to be inserted into <strong>kms-acls.xml</strong> for this role only.",
        "display_name": "Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-acls.xml",
        "name": "kms-acls.xml_role_safety_valve",
        "value": null
    },
    {
        "desc": "Hard memory limit to assign to this role, enforced by the Linux kernel. When the limit is reached, the kernel will reclaim pages charged to the process. If reclaiming fails, the kernel may kill the process. Both anonymous as well as page cache pages contribute to the limit. Use a value of -1 B to specify no limit. By default processes not managed by Cloudera Manager will have no limit.",
        "display_name": "Cgroup Memory Hard Limit",
        "name": "rm_memory_hard_limit",
        "value": "-1"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the hue user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "Hue Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_hue_hosts",
        "value": "*"
    },
    {
        "desc": "The period to review when computing unexpected exits.",
        "display_name": "Unexpected Exits Monitoring Period",
        "name": "unexpected_exits_window",
        "value": "5"
    },
    {
        "desc": "Encrypt communication between clients and Key Management Server using Transport Layer Security (TLS) (formerly known as Secure Socket Layer (SSL)).",
        "display_name": "Enable TLS/SSL for Key Management Server",
        "name": "ssl_enabled",
        "value": "false"
    },
    {
        "desc": "The log directory for log files of the role Key Management Server.",
        "display_name": "Key Management Server Log Directory",
        "name": "log_dir",
        "value": "/var/log/hadoop-kms"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the hive user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "Hive Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_hive_hosts",
        "value": "*"
    },
    {
        "desc": "For advanced use only, a string to be inserted into <strong>log4j.properties</strong> for this role only.",
        "display_name": "Key Management Server Logging Advanced Configuration Snippet (Safety Valve)",
        "name": "log4j_safety_valve",
        "value": null
    },
    {
        "desc": "For advanced use only, key-value pairs (one on each line) to be inserted into a role's environment. Applies to configurations of this role except client configuration.",
        "display_name": "Key Management Server Environment Advanced Configuration Snippet (Safety Valve)",
        "name": "KMS_role_env_safety_valve",
        "value": null
    },
    {
        "desc": "Port used by clients to interact with the KMS.",
        "display_name": "KMS HTTP Port",
        "name": "kms_http_port",
        "value": "16000"
    },
    {
        "desc": "Allows the yarn superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "YARN Proxy User Groups",
        "name": "hadoop_kms_proxyuser_yarn_groups",
        "value": "*"
    },
    {
        "desc": "If configured, overrides the process soft and hard rlimits (also called ulimits) for file descriptors to the configured value.",
        "display_name": "Maximum Process File Descriptors",
        "name": "rlimit_fds",
        "value": null
    },
    {
        "desc": "Allows the hue superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "Hue Proxy User Groups",
        "name": "hadoop_kms_proxyuser_hue_groups",
        "value": "*"
    },
    {
        "desc": "When set, Cloudera Manager will send alerts when the health of this role reaches the threshold specified by the EventServer setting eventserver_health_events_alert_threshold",
        "display_name": "Enable Health Alerts for this Role",
        "name": "enable_alerts",
        "value": "true"
    },
    {
        "desc": "Comma-delimited list of hosts where you want to allow the flume user to impersonate other users. The default '*' allows all hosts. To disable entirely, use a string that doesn't correspond to a host name, such as '_no_host'.",
        "display_name": "Flume Proxy User Hosts",
        "name": "hadoop_kms_proxyuser_flume_hosts",
        "value": "*"
    },
    {
        "desc": "The maximum size, in megabytes, per log file for Key Management Server logs.  Typically used by log4j or logback.",
        "display_name": "Key Management Server Max Log Size",
        "name": "max_log_size",
        "value": "200"
    },
    {
        "desc": "The password for the JavaKeyStoreProvider keystore file.",
        "display_name": "JavaKeyStoreProvider Password",
        "name": "hadoop_security_keystore_javaKeyStoreProvider_password",
        "value": null
    },
    {
        "desc": "The health test thresholds for unexpected exits encountered within a recent period specified by the unexpected_exits_window configuration for the role.",
        "display_name": "Unexpected Exits Thresholds",
        "name": "unexpected_exits_thresholds",
        "value": "{\"critical\":\"any\",\"warning\":\"never\"}"
    },
    {
        "desc": "When computing the overall Key Management Server health, consider the host's health.",
        "display_name": "Key Management Server Host Health Test",
        "name": "kms_host_health_enabled",
        "value": "true"
    },
    {
        "desc": "<p>The configured triggers for this role. This is a JSON formatted list of triggers. These triggers are evaluated as part as the health system. Every trigger expression is parsed, and if the trigger condition is met, the list of actions provided in the trigger expression is executed.</p><p>Each trigger has all of the following fields:</p><ul><li><code>triggerName</code> <strong>(mandatory)</strong> - The name of the trigger. This value must be unique for the specific role. </li><li><code>triggerExpression</code> <strong>(mandatory)</strong> - A tsquery expression representing the trigger. </li><li><code>streamThreshold</code> <strong>(optional)</strong> - The maximum number of streams that can satisfy a condition of a trigger before the condition fires. By default set to 0, and any stream returned causes the condition to fire. </li><li><code>enabled</code> <strong> (optional)</strong> - By default set to 'true'. If set to 'false', the trigger will not be evaluated.</li><li><code>expressionEditorConfig</code> <strong> (optional)</strong> - Metadata for the trigger editor. If present, the trigger should only be edited from the Edit Trigger page; editing the trigger here may lead to inconsistencies.</li></ul></p><p>For example, the following JSON formatted trigger configured for a DataNode fires if the DataNode has more than 1500 file-descriptors opened:</p><p><pre>[{\"triggerName\": \"sample-trigger\",\n  \"triggerExpression\": \"IF (SELECT fd_open WHERE roleName=$ROLENAME and last(fd_open) > 1500) DO health:bad\",\n  \"streamThreshold\": 0, \"enabled\": \"true\"}]</pre></p><p>See the trigger rules documentation for more details on how to write triggers using tsquery.</p><p>The JSON format is evolving and may change in the future and, as a result, backward compatibility is not guaranteed between releases at this time.</p>",
        "display_name": "Role Triggers",
        "name": "role_triggers",
        "value": "[]"
    },
    {
        "desc": "A comma-separated list of users (no spaces) for whom to disallow access to key material. These users can still fetch key metadata and create encrypted encryption keys, but are unable to do any other KMS operations. Typically, HDFS superusers will be specified here.",
        "display_name": "KMS Blacklist Users",
        "name": "kms_blacklist_users",
        "value": ""
    },
    {
        "desc": "The path to the TLS/SSL keystore file containing the server certificate and private key used for TLS/SSL. Used when Key Management Server is acting as a TLS/SSL server. The keystore must be in JKS format.",
        "display_name": "Key Management Server TLS/SSL Server JKS Keystore File Location",
        "name": "ssl_server_keystore_location",
        "value": ""
    },
    {
        "desc": "Allows the httpfs superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "HttpFS Proxy User Groups",
        "name": "hadoop_kms_proxyuser_httpfs_groups",
        "value": "*"
    },
    {
        "desc": "Directory where configuration and binaries are staged before starting KMS. Does not normally need to be modified.",
        "display_name": "KMS Staging Directory",
        "name": "kms_staging_dir",
        "value": "/var/lib/hadoop-kms"
    },
    {
        "desc": "For advanced use only, a string to be inserted into <strong>core-site.xml</strong> for this role only.",
        "display_name": "Key Management Server Advanced Configuration Snippet (Safety Valve) for core-site.xml",
        "name": "core-site.xml_role_safety_valve",
        "value": null
    },
    {
        "desc": "The maximum number of rolled log files to keep for Key Management Server logs.  Typically used by log4j or logback.",
        "display_name": "Key Management Server Maximum Log File Backups",
        "name": "max_log_backup_index",
        "value": "10"
    },
    {
        "desc": "Allows the flume superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "Flume Proxy User Groups",
        "name": "hadoop_kms_proxyuser_flume_groups",
        "value": "*"
    },
    {
        "desc": "Number of CPU shares to assign to this role. The greater the number of shares, the larger the share of the host's CPUs that will be given to this role when the host experiences CPU contention. Must be between 2 and 262144. Defaults to 1024 for processes not managed by Cloudera Manager.",
        "display_name": "Cgroup CPU Shares",
        "name": "rm_cpu_shares",
        "value": "1024"
    },
    {
        "desc": "Allows the HTTP superuser to impersonate any members of a comma-delimited list of groups. The default '*' allows all groups. To disable entirely, use a string that doesn't correspond to a group name, such as '_no_group_'.",
        "display_name": "HTTP Proxy User Groups",
        "name": "hadoop_kms_proxyuser_HTTP_groups",
        "value": "*"
    },
    {
        "desc": "Directory of the keystore file kms.keystore used by JavaKeyStoreProvider that backs the KMS.",
        "display_name": "JavaKeyStoreProvider Directory",
        "name": "hadoop_security_key_provider_dir",
        "value": "/var/lib/kms"
    },
    {
        "desc": "For advanced use only, a string to be inserted into <strong>kms-site.xml</strong> for this role only.",
        "display_name": "Key Management Server Advanced Configuration Snippet (Safety Valve) for kms-site.xml",
        "name": "kms-site.xml_role_safety_valve",
        "value": null
    },
    {
        "desc": "The minimum log level for Key Management Server logs",
        "display_name": "Key Management Server Logging Threshold",
        "name": "log_threshold",
        "value": "INFO"
    },
    {
        "desc": "Maximum heap size of the KMS.",
        "display_name": "KMS Heap Size",
        "name": "kms_heap_size",
        "value": "1073741824"
    },
    {
        "desc": "Port used to access the KMS' embedded Tomcat admin console.",
        "display_name": "KMS Admin Port",
        "name": "kms_admin_port",
        "value": "16001"
    }
]