Kerberos cluster

To perform an HDP intermediate bits upgrade using Ambari, your kerberized cluster must meet certain prerequisites.

important

For a Kerberized cluster, you must review and configure your KDC:

KDC Admin Credentials:
The Ambari Server adds new components as a part of the HDP 2.6.5.x to HDP intermediate bits upgrade and needs to be configured to enable password encryption and saving the KDC admin credentials so that necessary principals can be created. For steps on how to do this, see Encrypt Database and LDAP Passwords in Ambari, Managing Admin Credentials, and Authentication and Kerberos Issues.
KDC Admin Host FQDN:
Ensure that the KDC Admin host is set to a fully qualified domain name (FQDN) and not an IP address. You can check this setting by going to Services > Kerberos > Configs > KDC Hosts
KDC kadmin principal:
The MIT KDC integration in Ambari 7.1.x.x has been improved to connect more securely with the Kerberos Administration server (kadmind). This increased security expects a Kerberos admin service principal to be present with a specifically formatted principal name. The format expected is kadmin/fully.qualified.kdc.hostname@REALM. This expectation is a behavior change from previous versions of Ambari, where having such a Kerberos admin service principal was not required. This principal is present by default in most MIT KDC installations, but some customers have reported that this principal does not exist in their KDC. Due to this, it is recommended that before upgrading a kerberized cluster to Ambari 7.1.x.x, you ensure this principal exists in your KDC database.