@Kyle Pifer, I know you found a workaround now; nevertheless, we found the solution (because we experienced the same issue, the hard way): tez view is the problem. If you look at your ambari-server.log, you can see it tries to deploy the tez view, but never confirms it did. I don't know what's wrong with the tez view, neither why it only prevents starting ambari now since we did thousands of server restart for the past year, but if you move the tez view jar in /var/lib/ambari-server/resources/views to another folder, then ambari will start properly. Now, if you need the tez view, debugging it is another story... Hope this helps, cheers. ... View more

Very helpful, thank you. For a while, I thought that the "getkeytab retrieve mode" would allow getting headless keytab on all nodes without incrementing the KVNO. But, if I get it well, the retrieve mode only can be used for service keytabs, and not headless ones, right? ... View more

Thank you so much! This helps greatly. Quick question: when adding a new host to the cluster, until now, I needed to manually create the services in the KDC, and generate the keytabs on the host. But as of now, thanks to the kerberos_identities API call, does it mean I can just track the changes in kerberos_identities to automatically detect the identities related to the new host, and script the services and keytabs creation? Another way to put it: how soon, in the 'adding a new host' process, are the kerberos identities updated with the new identities? ... View more

Thank you. Hortonworks doc is very scarce about this. Never would have I guessed such commands without your article. Awesome! ... View more

Please also note the exact same error can be caused by missing Oracle JCE jar files. It turns out openJDK ships JCE policy jar files compatible with HDP, but not the Oracle JVM. Hence, the extensions should be installed (even if the $JAVA_HOME/lib/security folder already contain the jars, they may not be then proper ones). I learnt this the hard way. ... View more

THANK YOU! I barely can imagine how many nights you wasted on this. This vicious issue appeared suddenly when we installed FreeIPA client on centos 7 nodes. Whereas, on CentOS 6.7, the KEYRING was absent... ... View more