Very helpful, thank you. For a while, I thought that the "getkeytab retrieve mode" would allow getting headless keytab on all nodes without incrementing the KVNO. But, if I get it well, the retrieve mode only can be used for service keytabs, and not headless ones, right? ... View more

Thank you so much! This helps greatly. Quick question: when adding a new host to the cluster, until now, I needed to manually create the services in the KDC, and generate the keytabs on the host. But as of now, thanks to the kerberos_identities API call, does it mean I can just track the changes in kerberos_identities to automatically detect the identities related to the new host, and script the services and keytabs creation? Another way to put it: how soon, in the 'adding a new host' process, are the kerberos identities updated with the new identities? ... View more

Thank you. Hortonworks doc is very scarce about this. Never would have I guessed such commands without your article. Awesome! ... View more