Hi @lwang , thanks for your input.
Cloudera manager version is 5.8.5, and CDH 5.4.4 (do they have to be the same version?)
No, I haven't used the wizard for Kerberos. And I've checked the krb5.conf file - it looks fine, but here it is just for the sake of having another pair of eyes on it 🙂
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
ticket_lifetime = 86400
renew_lifetime = 604800
forwardable = true
default_tgs_enctypes = rc4-hmac
default_tkt_enctypes = rc4-hmac
permitted_enctypes = rc4-hmac
udp_preference_limit = 1
kdc_timeout = 3000
[appdefaults]
validate = false
[realms]
EXAMPLE.COM = {
kdc = bdmanager1-test2.example.com:88
admin_server = bdmanager1-test2.example.com:749
#default_domain = example.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
`krb5.conf` is deployed to all hosts, that's not the issue here.
Let me give an example. When I do "Import KDC admin credentials" from the Cloudera Manager UI and right after it's done I do "Generate missing credentials" - it works.
If I execute any commands in between, for example I do "Import cluster template" and that itself will call "Generate missing credentials" after deploying the parcels and applying host templates, then "Generate missing credentials" fails with the error that I specified above. If I manually again do "Import KDC admin credentials" and then "Generate missing credentials" - again it works.
The error comes from the script that is triggered by the "Generate missing credentials" command, located at `/usr/share/cmf/bin/gen_credentials.sh`, as it sets incorrect realm for `CMF_REALM` variable (as can be seen from the stack trace above), hence the error.
As a workaround I've explicitly set `CMF_REALM=EXAMPLE.COM` in that script, but that's not ideal so I am trying to get to the bottom of why this is happening.
Hope my ramblings make any sense 🙂
