FWIW I seem to have found a solution.   I had added  a call to  ugi.checkTGTAndReloginFromKeytab() but it hadn't worked.   Later in debugging I found that that call was trying to renew the Proxy User, not the underlying principal.   I changed the call so that it would get the principal's ugi and call the same method on that and now it seems to work.   There are still outstanding questions, though, if anyone cares to investigate further:   Why was this only necessary for D.A.R.E. ?  All other ops (hdfs, Hive, yarn, etc.) continued working and renewing krbtgt's perpetually Was the upgrade of CDH needed or would it have continued working with the older version? ... View more

Hi Tim,   I'd like to resond and say that we were running into the issues that you brought up, I will also note that changing our double values of 1200 to 1200.0 does seem to remedy that particular problem.   Thank you for your response. ... View more