Related post: https://community.hortonworks.com/questions/176408/hdp-264-problem-during-application-of-kerberos.html Hello, I faced to some issues during the creation of one kerberized cluster with Ambari blueprint. All the issues are resolved. This post is only a feedback (for sharing) Here after the different issues
- (Minor) Unset variable {{policymgr_mgr_url}} in the blueprint that
causes this error in /var/lib/ambari-agent/data/output-XX.txt:
"..returned 3. curl: (3) [globbing] nested braces not supported at pos
2\n",). Sleeping for 8 sec(s)". This error increases significantly the time to create cluster (lot of retries) => resolved by setting the parameter in the blueprint. {
"ranger-hdfs-security" : {
"properties_attributes" : { },
"properties" : {
"ranger.plugin.hdfs.policy.source.impl" : "org.apache.ranger.admin.client.RangerAdminRESTClient",
"ranger.plugin.hdfs.policy.rest.url" : "http://XXX:6080"
}
}
}
- (Minor) Install of KMS failed due to an unset db password. => resolved by defined this KMS user/password in blueprint
{
"kms-properties" : {
"properties_attributes" : { },
"properties" : {
"DB_FLAVOR" : "MYSQL",
...
"db_user" : "XXX",
"db_password" : "XXXX"
}
}
}
- (Major) The main problem is the fact that Kerberos
keytabs are not been copied by Ambari onto one server of my cluster.
This server hosts some HDP components especially a journalnode. Without
keytabs, the journalnode cannot start.
Thus, format of the Namenode when the cluster is starting fails. This
process is in background and logs are in a dedicated logs file. That´s
why it´s not really obvious.
Workaround: when, I force manually the "Regenerate keytabs" through
Ambari UI (Admin/Kerberos), Keytabs are well generated and copied onto
this server. Then, the journalnode is able to start and then Namenodes. => resolved. As soon as I've resolved the other problems (KMS, policymgr_mgr_url...), this problem has been resolved automatically. To my point of view, the error in the install of the other components blocked the propagation of the keytabs. Not really obvious to identify. Regards, David
... View more
