Putting Impala Behind A Load Balancer - Kerberos Principal Generation in CM

[#1]

Good day.  We are working on a project to put our Impalad nodes behind a load balancer.  We are running CM/CDH 5.4.5 and using the instructions found here.

http://www.cloudera.com/content/www/en-us/documentation/enterprise/5-4-x/topics/impala_proxy.html#pr...

From what we observed, it looks like when using CM, after entering our load balancer dns:port (e.g. our.load.balancer.company.com:25003) into the "Impala Daemons Load Balancer" section, CM does most all the hard work of merging keytabs and setting the custom command line arguments (e.g. --be_principal) for us.  This is great.

Unfortunately after adding in our load balancer we are running into the error: "Role is missing Kerberos keytab." in CM.

Now, one of the things we were unsure of is whether CM will actually create the principal and keytab for the load balancer.  For example, when looking at our CM managed Kerberos principals, there is no "impala/our.load.balancer.company.com@COMPANY.COM"

Any idea if we need to pre-create and manage the 'impala/our.load.balancer.company.com@COMPANY.COM' outside of CM?  Or would you expect CM to actually create that principal for us as part of adding in the “Impala Daemons Load Balancer” configuration?

Thanks in advance.

[#2 · Accepted solution]

You just need to go to the kerberos page and generate the missing keytab.

Administration -> Security, click the tab for Kerberos Credentials, click Generate Missing Credentials.

Thanks,
Darren

[#3]

Thanks!  Indeed that seemed to take care of it.  Pretty slick.  You guys did a very good job on making that easy for us.

Now to start testing.  Thanks again!