Skip to main content
vbonthu
vbonthu
Gold ⭐️
June 5, 2018

Regenerating Kerberos Keytabs from Ambari API

  • October 5, 2026 at 8:50 AM
  • 1 reply
  • 3706 views
  • Translate All

Short Description:

Describes ways to manually regenerate keytabs for services through Ambari REST API

Article

Make sure KDC credentials are added to Ambari credentials store. You can follow this Article to perform.

Once KDC credentials are added. You can use the below Ambari's REST API to regenerate keytabs.

curl -H "X-Requested-By:ambari" -u <Ambari_Admin_username>:<Amabri_Admin_password> -X PUT -d '{ "Clusters": { "security_type" : "KERBEROS" } }' http://<Ambari_HOST>:8080/api/v1/clusters/<Cluster_Name>/?regenerate_keytabs=all

Example :

curl -H "X-Requested-By:ambari" -u admin:admin -X PUT -d '{ "Clusters": { "security_type" : "KERBEROS" } }' http://172.26.108.142:8080/api/v1/clusters/vinod/?regenerate_keytabs=all&ignore_config_updates=true


Once the Keytabs are regenerated it requires Service restart to use the newly generated keytabs.


    1 reply

    Kartik_Agarwal
    Platinum ⭐️
    Kartik_Agarwal
    Platinum ⭐️
    September 30, 2021

    To invoke kerberos related operations via Ambari APIs requires, we store the KDC credentials to the Ambari's credential store.

    For more information on the same please refer to: https://community.cloudera.com/t5/Community-Articles/Adding-KDC-Administrator-Credentials-to-the-Ambari/ta-p/246591

     

    1. To set up Ambari's credential store, the following command must be invoked from the Ambari server host's command line:

    # ambari-server setup-security

    Then choose option [2] Encrypt passwords stored in ambari.properties file.

     

    2. Review the changes. Once this is complete, the Ambari credential store will be located at /var/lib/ambari-server/keys/credentials.jceks.

     

    3. Restart ambari server.

     

    4. Now we should be able to store the KDC credentials to the ambari credentials store.

     

    # curl -u admin:admin -H 'X-Requested-By: ambari' -X POST -d '{ 'Credential' : {'principal' : 'admin/admin@EXAMPLE.COM', 'key' : 'admin','type' : 'persisted'}}' http://example.com:8080/api/v1/clusters/kerberos_ambari/credentials/kdc.admin.credential

     

    5. After this we should be able to run the Kerberos API calls like following:

     

    Regenerate for all

     

    curl -u admin:admin -H 'X-Requested-By: ambari' -X PUT -d '{'Clusters':{'security_type':'KERBEROS'}}' http://example.com:8080/api/v1/clusters/kerberos_ambari?regenerate_keytabs=all

     

    (OR) Below is for missing once.

     

    curl -u admin:admin -H 'X-Requested-By: ambari' -X PUT -d '{'Clusters':{'security_type':'KERBEROS'}}' http://example.com:8080/api/v1/clusters/kerberos_ambari?regenerate_keytabs=missing

    Translate
    Terms & ConditionsAccessibility statement