Constraints we worked within.
- Console access only
- No shell and no direct database connection: every step went through Hue, Cloudera Manager, NiFi, Ranger and Atlas.
- Kerberos and TLS everywhere
- Every client, from NiFi flows to Kafka producers, authenticates with Kerberos over TLS. No shortcuts.
- Planned engines unavailable
- The streaming and Spark engines in the design were not available, so it went SQL-first on Hive and Impala, with one rule: ingestion writes only the raw layer, and SQL builds everything above it.
- No official data dictionary yet
- The attribute model follows public descriptions and is built to be swapped for the official one.