Hadoop NameNode and ResourceManager UIs: no documented accessibility conformance for assistive technology

Answer

The Hadoop 3.3.x NameNode (port 9870) and ResourceManager (port 8088) UIs have no published WCAG conformance statement and contain minimal ARIA or keyboard‑friendly markup.

Confirmed facts

• The UIs are Jetty‑served JSP/HTML pages that display data via HTML tables and rely on simple inline JavaScript.
• Apache Hadoop JIRA tracks open accessibility tickets such as HADOOP-16234 (ARIA labels for NameNode tables) and HADOOP-17012 (keyboard‑navigable ResourceManager filters); none have been merged into a released version.
• Because the UIs expose only read‑only JMX/REST data, adding ARIA roles, labels, and logical tab order via a front‑end overlay does not affect the Kerberos/SPNEGO authentication filter chain.

Likely explanation / community guidance

The project treats these UIs as operational consoles rather than end‑user applications, so accessibility work has been driven by individual contributors rather than a formal roadmap. When formal WCAG compliance is required, the community recommends consuming the NameNode/ResourceManager REST/JMX endpoints with a custom dashboard (e.g., Ambari, Grafana, or a lightweight React/Vue app) where accessibility can be fully controlled.

Steps to harden the built‑in UIs without breaking security

1. Deploy a reverse‑proxy (e.g., NGINX, Envoy) in front of ports 9870 and 8088.
2. Configure the proxy to inject a small HTML header or to serve a custom JSP overlay that adds:
   • ARIA roles (e.g., role="region", aria‑labelledby) to table containers.
   • Label elements for form inputs and skip‑to‑content links.
   • Logical tabindex order and visible focus outlines.
3. Ensure the proxy forwards all request headers unchanged, especially WWW‑Authenticate and Set‑Cookie, so Kerberos/SPNEGO negotiation remains intact.
4. Leave the underlying Hadoop security filters (read‑only mode, authentication) untouched; the overlay only modifies the response body.
5. Validate the overlay after each Hadoop patch release to confirm that injected markup does not clash with new IDs or scripts.

Missing diagnostic detail

Do you have the ability to place a reverse‑proxy or overlay in front of the NameNode and ResourceManager ports? If not, the only viable path is to build an external dashboard that consumes the REST/JMX endpoints.