Hi @michalLi ,  I have been trying this in CDP PvC now but does not seem to work . Here is the behavior i see for spark history server web ui (7.1.7.2000) TLS enabled and kerberos enabled : without keytab https://172.25.42.2:18088 works fine TLS disabled and kerberos enabled : with/without keytab http://172.25.42.2:18088 is failing for 401 Auth in Mac OS/Chrome   ... View more

some more information to add:   it seems that in DbTxnManager, failed or terminated sql queries will not leave stale locks behind, as there are heartbeat mechanisms involved. Only when the hs2 process is not functioning properly, like when the hs2 host crashed, will there be staled locks left behind, and we have to manually clear them by logging into the metastore db.      ... View more