Skip to main content
johndoe84
johndoe84
Bronze ⭐️⭐️⭐️
August 1, 2014
Solved

How to Identify Service-Specific Kerberos Keytabs in Cloudera Manager

Hello

 

I have a Clouder Manager 4.8 cluster with Kerberos enabled

 

When I configured HDFS/Hbase/Zookeeper to use Kerberos, Cloudera Manager generated all the principals and keytabs for all the services on each node

 

However, I have two unmanaged namenodes that I want to use as part of my cluster - Cloudera Manager does not know about these nodes, so it did not generate the principals and keytabs for the services on these nodes

 

I followed the steps for generating the keytabs/principals as part of the manual CDH setup, but the guide told me to move my keys tabs to /etc/hadoop/conf, but there are no other keytabs in that folder

 

So I need to know where does Cloudera Manager store its generated keytabs

 

Or am I supposed to merge the manually created keytabs with the generated keytabs somehow?

 

Thanks for any help in advance

    Kartik_Agarwal
    Kartik_AgarwalAnswer
    Platinum ⭐️
    September 23, 2021

    They will be in the process directory for the component. For example:

     

    hive.keytab is in:

    /var/run/cloudera-scm-agent/process/*-hive_on_tez-HIVESERVER2

     

    View in thread

    6 replies

    Grizzly
    Gold ⭐️⭐️
    Grizzly
    Gold ⭐️⭐️
    August 2, 2014

    The keytabs are pushed from a database to a runtime location at startup of services, what you are describing as a configuration is not really viable from what I understand.

     

    You will see /var/run/cloudera-scm-agent/process/  but this is ephemeral, next restart will have another locaiton.

     

    You could experiment with trying to provide the manual keytabs through safety valve to the necessary services.


    Todd

    Translate
      shailesh001
      shailesh001
      Silver ⭐️⭐️
      October 12, 2014

      I too am having problems with keytabs when I enable Kerberos in CDH 5.1.3, I have the following in /var/run :

       

      ./cloudera-scm-agent/process/92-cloudera-mgmt-SERVICEMONITOR/hue.keytab

      ./cloudera-scm-agent/process/89-cloudera-mgmt-REPORTSMANAGER/hdfs.keytab

      ./cloudera-scm-agent/process/88-cloudera-mgmt-ACTIVITYMONITOR/hue.keytab

      ./cloudera-scm-agent/process/87-cloudera-mgmt-HOSTMONITOR/hue.keytab

       

      These keytabs don't look correct.  Where does it get them from?

       

      Thanks

      Shailesh

      Translate
        Grizzly
        Gold ⭐️⭐️
        Grizzly
        Gold ⭐️⭐️
        October 12, 2014

        Cloudera Manager passes configuration and those keytabs through the agent at startup of the CDH processes configured to run on that cluster server.

         

        Those are correct keytabs to be distributed to those services.

         

        The monitoring services re-use the hue keytab for their activity with cluster nodes.

         

        For the HDFS keytab present that is for functionality within reports manager that requires access to hdfs information.

         

        The principal names are described within the SCM management DB, as well as the merged keytabs for the roles as gathered from the credentials table.

         

        Todd

        Translate
          obar101
          obar101
          Silver ⭐️⭐️
          December 25, 2019
          export dirname=/var/run/cloudera-scm-agent/process/
          sudo find $dirname -not -empty `-ls -l` | grep keytab
          Translate
          Kartik_Agarwal
          Platinum ⭐️
          Kartik_AgarwalAnswer
          Platinum ⭐️
          September 23, 2021

          They will be in the process directory for the component. For example:

           

          hive.keytab is in:

          /var/run/cloudera-scm-agent/process/*-hive_on_tez-HIVESERVER2

           

          Translate
            Terms & ConditionsAccessibility statement