Created 04-18-2019 01:51 AM
I have a cluster of 350+ nodes ( Edge Nodes, Ingestion Nodes, Management Nodes & Worker Nodes) and all these managed by Ambari. All the Management nodes and Worker nodes are up-to-date with the latest Krb5.conf file. However the Edge Nodes and Ingestion Nodes Krb5.conf file is not updated and missing an entry.
Hence My question is, If I modify the krb5.conf file in the Edge nodes & Ingestion nodes Manually to match with the same krb5.conf file in the remaining nodes, what would be the impact? Which all components would require restart? How do i go about syncing them up?
No master services or client services are installed on these nodes. However they are part of the cluster.
Any help would be appreciated.
Created 04-18-2019 10:44 AM
Firstly you really don't need to modify manually the krb5.conf as they MUST be identical on all the cluster nodes. What you should do is run scp from the Ambari server where you configured the passwordless connection.
Assuming your Ambari Server hosts file entry has all the cluster node and egdenode1 is your target
# scp /etc/krb5.conf root@edgnode1:/etc/
This will copy and overwrite the incorrect krb5.conf on the edge node. Assuming you have a user named analyst01 on the edge node who intends to run a job after the update you will do the following as user analyst1 assuming he has his keytab in his home directory
# su - analyst01
To determine if he has a valid ticket, in the below he didn't have one
# klist
klist: No credentials cache found (filename: /tmp/krb5cc_0)
Grab a ticket
$ kinit -kt /home/analyst01/analyst01.keytab
Now he should be able to grab a valid ticket and the klist should validate that
$ klist Ticket cache: FILE:/tmp/krb5cc_1013 Default principal: analyst01-xxx@{REALM} Valid starting Expires Service principal 04/13/2019 23:25:32 04/14/2019 23:25:32 krbtgt/_host@{REALM} 04/13/2019 23:25:32 04/14/2019 23:25:32 HTTP/_host@{REALM}
You don't need to restart any services on the edge node !
Created 04-18-2019 10:44 AM
Firstly you really don't need to modify manually the krb5.conf as they MUST be identical on all the cluster nodes. What you should do is run scp from the Ambari server where you configured the passwordless connection.
Assuming your Ambari Server hosts file entry has all the cluster node and egdenode1 is your target
# scp /etc/krb5.conf root@edgnode1:/etc/
This will copy and overwrite the incorrect krb5.conf on the edge node. Assuming you have a user named analyst01 on the edge node who intends to run a job after the update you will do the following as user analyst1 assuming he has his keytab in his home directory
# su - analyst01
To determine if he has a valid ticket, in the below he didn't have one
# klist
klist: No credentials cache found (filename: /tmp/krb5cc_0)
Grab a ticket
$ kinit -kt /home/analyst01/analyst01.keytab
Now he should be able to grab a valid ticket and the klist should validate that
$ klist Ticket cache: FILE:/tmp/krb5cc_1013 Default principal: analyst01-xxx@{REALM} Valid starting Expires Service principal 04/13/2019 23:25:32 04/14/2019 23:25:32 krbtgt/_host@{REALM} 04/13/2019 23:25:32 04/14/2019 23:25:32 HTTP/_host@{REALM}
You don't need to restart any services on the edge node !
Created 04-18-2019 02:53 PM
Thank You @Geoffrey Shelton Okot. This is something i was looking for. I will have this checked and validated.