question In HDP 2.6.5 Cluster managed by Ambari 2.6.2.2, Which all components will ask for restart if i Update krb5.conf file on few of the Edge nodes & Ingestion Nodes? in Support Questions

In HDP 2.6.5 Cluster managed by Ambari 2.6.2.2, Which all components will ask for restart if i Update krb5.conf file on few of the Edge nodes & Ingestion Nodes?

Afroz_Baig — Thu, 18 Apr 2019 08:51:30 GMT

I have a cluster of 350+ nodes ( Edge Nodes, Ingestion Nodes, Management Nodes & Worker Nodes) and all these managed by Ambari. All the Management nodes and Worker nodes are up-to-date with the latest Krb5.conf file. However the Edge Nodes and Ingestion Nodes Krb5.conf file is not updated and missing an entry.

Hence My question is, If I modify the krb5.conf file in the Edge nodes & Ingestion nodes Manually to match with the same krb5.conf file in the remaining nodes, what would be the impact? Which all components would require restart? How do i go about syncing them up?

No master services or client services are installed on these nodes. However they are part of the cluster.

Any help would be appreciated.

Re: In HDP 2.6.5 Cluster managed by Ambari 2.6.2.2, Which all components will ask for restart if i Update krb5.conf file on few of the Edge nodes & Ingestion Nodes?

Shelton — Thu, 18 Apr 2019 17:44:24 GMT

@Afroz Baig

Firstly you really don't need to modify manually the krb5.conf as they MUST be identical on all the cluster nodes. What you should do is run scp from the Ambari server where you configured the passwordless connection.

Assuming your Ambari Server hosts file entry has all the cluster node and egdenode1 is your target

# scp /etc/krb5.conf root@edgnode1:/etc/

This will copy and overwrite the incorrect krb5.conf on the edge node. Assuming you have a user named analyst01 on the edge node who intends to run a job after the update you will do the following as user analyst1 assuming he has his keytab in his home directory

# su - analyst01

To determine if he has a valid ticket, in the below he didn't have one

# klist

klist: No credentials cache found (filename: /tmp/krb5cc_0)

Grab a ticket

$ kinit -kt /home/analyst01/analyst01.keytab

Now he should be able to grab a valid ticket and the klist should validate that

$ klist 
Ticket cache: FILE:/tmp/krb5cc_1013 
Default principal: analyst01-xxx@{REALM} 
Valid starting       Expires              Service principal 
04/13/2019 23:25:32  04/14/2019 23:25:32  krbtgt/_host@{REALM} 
04/13/2019 23:25:32  04/14/2019 23:25:32  HTTP/_host@{REALM}

You don't need to restart any services on the edge node !

Re: In HDP 2.6.5 Cluster managed by Ambari 2.6.2.2, Which all components will ask for restart if i Update krb5.conf file on few of the Edge nodes & Ingestion Nodes?

Afroz_Baig — Thu, 18 Apr 2019 21:53:15 GMT

Thank You @Geoffrey Shelton Okot. This is something i was looking for. I will have this checked and validated.