We have several realms in our company and we plan to dedicate one to our Hadoop cluster managed by Ambari. Let's say we have: PROD.COM #default realm to be used by production services HADOOP.COM #dedicated for Hadoop cluster And it is mandatory for us to have PROD.COM as default realm in krb5.conf. However with PROD.COM as default realm I always get this error after successful kinit as hdfs: [root@hadoop-poc2-01:/etc] kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs-poc2@HADOOP.COM [root@hadoop-poc2-01:/etc] hadoop fs -ls / 16/07/11 13:28:39 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 600 seconds before. 16/07/11 13:28:40 WARN ipc.Client: Couldn't setup connection for hdfs-poc2@HADOOP.COM to hadoop-poc2-01.int.na.prod.com/172.30.52.136:8020 javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds)] With default realm set to HADOOP.COM it just works. Any hints? Thx ... View more

I have successfully enabled Kerberos for Ambari managed cluster. I have used the Wizard to generate the principals and everything. However the datanodes do not connect to namenodes. The reason is following: 2016-07-08 16:10:54,753 INFO ipc.Server (Server.java:doRead(891)) - Socket Reader #1 for port 8020: readAndProcess from client 172.30.52.137 threw exception [org.apache.hadoop.security.authorize.AuthorizationException: User dn/hadoop-poc2-02.int.na.prodxxx.com@HADOOPXXX.COM (auth:KERBEROS) is not authorized for protocol interface org.apache.hadoop.hdfs.server.protocol.DatanodeProtocol, expected client Kerberos principal is dn/172.30.52.137@HADOOPXXX.COM] They expect principals containing IP address instead of hostnames... I have checked the keytabs and it is generated properly: Keytab name: FILE:dn.service.keytab KVNO Principal ---- -------------------------------------------------------------------------- 1 dn/hadoop-poc2-02.int.na.prodxxx.com@HADOOPXXX.COM 1 dn/hadoop-poc2-02.int.na.prodxxx.com@HADOOPXXX.COM 1 dn/hadoop-poc2-02.int.na.prodxxx.com@HADOOPXXX.COM 1 dn/hadoop-poc2-02.int.na.prodxxx.com@HADOOPXXX.COM 1 dn/hadoop-poc2-02.int.na.prodxxx.com@HADOOPXXX.COM Any hints? ... View more

Hi, I have switched Ambari Metrics from "embedded" mode to "distributed" mode and it seems to work well. However I do not have HBASE service deployed in the cluster, but I assume that Ambari Metrics is using HBASE is standalone mode. The question is wether Ambari Metrics can benefit somehow from the HBASE service running on my cluster. ... View more