[
https://issues.apache.org/jira/browse/AMBARI-22654?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16291116#comment-16291116
]
Robert Levas commented on AMBARI-22654:
---------------------------------------
[~Maciej.Sitarz]....
There is a known issue related to Kerberos-related configurations (or existing
services) are not be updated when new services (or components) are added to a
cluster where Kerberos has been enabled. This is due to an ambiguity issue
where some configurations should be updated and some should be left unchanged.
Ambari is not yet smart enough to know what which fall under those categories.
As for your issue, new services should be properly configured for Kerberos and
needed Kerberos identities should be created when transitioning from INIT to
INSTALL. I have not come across a scenario where this was not happening for a
while... especially Ambari 2.5.2. However there may be a case where a
Yarn-related Kerberos identity is not created when installing Hive or the
interactive Hive server (LLAP, HSI, ?).
If you have a set of steps that can be used to reproduce the issue. If so, I
will be happy to run through it and see that the issue may be.
> Kerberos: Kerberos-related tasks occur after INSTALL stage of services being
> added
> ----------------------------------------------------------------------------------
>
> Key: AMBARI-22654
> URL: https://issues.apache.org/jira/browse/AMBARI-22654
> Project: Ambari
> Issue Type: Bug
> Components: ambari-server
> Affects Versions: 2.4.3, 2.5.2
> Reporter: Maciej Sitarz
> Priority: Critical
>
> Kerberos-related configs (keytab,principal creation) are not applied before
> INSTALL command is built on add service.
> This occurs when new services and components are added to an existing cluster
> where Kerberos is enabled. Due to the order Kerberos-related configurations
> (keytabs, principals) will not be available for new services INSTALL step
> functions.
> This seems to be identical problem to the one mentioned in #AMBARI-17772
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
