Cloudera Docs

HBase snapshots on Amazon S3 with Kerberos enabled

YARN should by default allow the hbase user to run MapReduce jobs even when Kerberos is enabled.

If Kerberos is enabled on your cluster, and YARN does not allow the hbase user to run MapReduce jobs, perform the following steps
  1. Open the YARN service page in Cloudera Manager.
  2. Select Scope > NodeManager.
  3. Select Category > Security.
  4. In the Allowed System Users property, click the + sign and add hbase to the list of allowed system users.
  5. Click Save Changes.
  6. Restart the YARN service.