question Re: Where is "Regenerate kerberos" button ? in Support Questions

Where is "Regenerate kerberos" button ?

ygb — Mon, 19 Aug 2019 10:19:56 GMT

Hi,

I have to regenerate hdfs.healess.keytab and looked for the cleanest way to do it. Ambari 2.2 documentation (§ 7.3.1: how to regenerate keytabs) exactly refers to a "Regenerate Kerberos" button:

but I can't find it !

Has this functionality been removed ?

Thanks.

Re: Where is "Regenerate kerberos" button ?

aervits — Wed, 03 Feb 2016 20:52:38 GMT

Did you lookin advanced tab? @YG B

Re: Where is "Regenerate kerberos" button ?

nsabharwal — Wed, 03 Feb 2016 21:01:47 GMT

@YG B

You may be right. I don't see any reference in Ambari 2.2 docs. Let me check with engineering.

I do see reference in 2.1

https://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.1/bk_Ambari_Users_Guide/content/_how_to_regenerate_keytabs.html

Re: Where is "Regenerate kerberos" button ?

bleonhardi — Wed, 03 Feb 2016 21:02:45 GMT

Which version of Ambari are you running? 2.2 like the docu?

It was removed in one version but reintroduced pretty much immediately and I definitely have it in 2.1.2. So it would be weird if it was gone in 2.2

https://issues.apache.org/jira/browse/AMBARI-12707

Re: Where is "Regenerate kerberos" button ?

ygb — Wed, 03 Feb 2016 21:05:01 GMT

Yes I did, but this tab is only dedicated to specific parameters for each service. No regenerate functionality.

Re: Where is "Regenerate kerberos" button ?

ygb — Wed, 03 Feb 2016 21:07:56 GMT

There is the section in Ambari 2.2 User guide: http://docs.hortonworks.com/HDPDocuments/Ambari-2.2.0.0/bk_Ambari_Users_Guide/content/_how_to_regenerate_keytabs.html

Re: Where is "Regenerate kerberos" button ?

ygb — Wed, 03 Feb 2016 21:09:58 GMT

Ambari 2.2.0 & HDP 2.3.4.0

Re: Where is "Regenerate kerberos" button ?

nsabharwal — Wed, 03 Feb 2016 21:11:59 GMT

Thanks @YG B

Please check again and if you don't see it then I will open a ticket for this.

Re: Where is "Regenerate kerberos" button ?

ygb — Wed, 03 Feb 2016 21:17:46 GMT

Interesting. Branch 2.1 has been patched but I wonder if the 2.2 was.

Re: Where is "Regenerate kerberos" button ?

ygb — Wed, 03 Feb 2016 21:25:13 GMT

I checked one more time with several browsers and the button doesn't appear.

Thanks for your help.

Re: Where is "Regenerate kerberos" button ?

aervits — Wed, 03 Feb 2016 22:42:52 GMT

@mahadev @yusaku @smohanty

Re: Where is "Regenerate kerberos" button ?

rlevas — Wed, 03 Feb 2016 22:49:39 GMT

In Ambari 2.2.0, the Regenerate Keytabs button should be available, if Kerberos was enabled using the MIT KDC or Active Directory options, not the manual option. In the manual case, the user is responsible for managing the Kerberos identities and therefore must manually create and distribute the keytab files. Because of this, the Regenerate Keytabs button will not be available.

However, if either the MIT KDC or Active Directory options were selected, than maybe you have hit an issue that seems to have been introduced in Ambari 2.1.2 and hopefully fixed in Ambari 2.2.1. This issue causes service configurations to get removed from the Ambari database. I am not sure what is causing this; however if the Kerberos-related configurations are affected the Regenerate Keytabs button will go missing. Other issue will be seen as well. For example starting and stopping some services may encounter an error claiming the kerberos-env configurations is missing and the request operation fails to go through.

To fix this issue, the keberos-env and krb5-conf configuration need to be recreated via the Ambari REST API.

For example:

PUT /api/v1/clusters/CLUSER_NAME
[
  {
    "Clusters": {
      "desired_config": {
        "type": "krb5-conf",
        "tag": "version1",
        "properties": {
          "domains":"",
          "manage_krb5_conf": "true",
          "conf_dir":"/etc",
          "content" : "[libdefaults]\n  renew_lifetime = 7d\n  forwardable= true\n  default_realm = {{realm|upper()}}\n  ticket_lifetime = 24h\n  dns_lookup_realm = false\n  dns_lookup_kdc = false\n  #default_tgs_enctypes = {{encryption_types}}\n  #default_tkt_enctypes ={{encryption_types}}\n\n{% if domains %}\n[domain_realm]\n{% for domain in domains.split(',') %}\n  {{domain}} = {{realm|upper()}}\n{% endfor %}\n{%endif %}\n\n[logging]\n  default = FILE:/var/log/krb5kdc.log\nadmin_server = FILE:/var/log/kadmind.log\n  kdc = FILE:/var/log/krb5kdc.log\n\n[realms]\n  {{realm}} = {\n    admin_server = {{admin_server_host|default(kdc_host, True)}}\n    kdc = {{kdc_host}}\n }\n\n{# Append additional realm declarations below #}\n"
        }
      }
    }
  },
  {
    "Clusters": {
      "desired_config": {
        "type": "kerberos-env",
        "tag": "version1",
        "properties": {
          "kdc_type": "mit-kdc",
          "manage_identities": "true",
          "install_packages": "true",
          "encryption_types": "aes des3-cbc-sha1 rc4 des-cbc-md5",
          "realm" : "EXAMPLE.COM",
          "kdc_host" : "hdc.host",
          "admin_server_host" : "kadmin.host",
          "executable_search_paths" : "/usr/bin, /usr/kerberos/bin, /usr/sbin, /usr/lib/mit/bin, /usr/lib/mit/sbin",
          "password_length": "20",
          "password_min_lowercase_letters": "1",
          "password_min_uppercase_letters": "1",
          "password_min_digits": "1",
          "password_min_punctuation": "1",
          "password_min_whitespace": "0",
          "service_check_principal_name" : "${cluster_name}-${short_date}",
          "case_insensitive_username_rules" : "false"
        }
      }
    }
  }
]

NOTE: This example will need to be modified to set the appropriate properties for the relevant cluster.

Re: Where is "Regenerate kerberos" button ?

ygb — Thu, 04 Feb 2016 18:48:50 GMT

Many thanks. The button is back !