Enable MultiKDC

This document explains the process of enabling multi KDC in a Pulse environment which is already deployed.

Manual Modifications

Enable Multi-KDC Flag

• Modify the accelo.yml file by executing the following sub-steps.
  • Open the$AcceloHome/config/accelo.yml file.
  • Change the IsMultiKDCclusterEnabled flag to true, if not yet set.

The updated file looks as follows.

ContainerRegistry: 191579300362.dkr.ecr.us-east-1.amazonaws.com/acceldata
ImageTag: 3.2.1
ContainerRegistryID: ""
ContainerRegistryKey: ""
ContainerUserID: 1000:1000
ContainerLogType: json-file
ContainerLogOpts:
 max-buffer-size: 4m
 max-file: "3"
 max-size: 10m
 mode: non-blocking
IsMultiKDCclusterEnabled: true
KerberosAddons:
- ad-connectors
- ad-kafka-connector
- ad-kafka-0-10-2-connector
- ad-impala-connector
- ad-fsanalyticsv2-connector
- ad-sparkstats

• Push the changes to the database by executing the following command.

accelo admin database push-config -a

Copy Kerberos File

The following steps demonstrate the process to copy the Kerberos files of the first cluster.

• Execute the config kerberos command.

accelo config kerberos -n <Active Name node URL>

• Provide the principal of the first cluster, (The following code block shows an example of this).

Enter the principal: : hdfs@ACCELDATA.COM

• Provide the Keytab file path of the first cluster. (The following code block shows an example of this).

Enter full path to the Keytab file (eg: /root/hdfs.keytab): : /data01/acceldata/kerberos.keytab

• Provide the krb5.conf file path of the first cluster:

Enter the krb5Conf file path: : /data01/acceldata/krb5.conf

The output is as follows.

[root@pulse01:acceldata (ad-default)]$ accelo config kerberos -n http://hdp3101.dev.axl.iti:8042
Setting up kerberos..
Setting up kerberos..
Enter the principal: : hdfs@ACCELDATA.COM
Enter full path to the Keytab file (eg: /root/hdfs.keytab): : /data01/acceldata/kerberos.keytab
Enter the krb5Conf file path: : /data01/acceldata/krb5.conf
WARN: /data01/acceldata/work/ad_hdp3_dev/krb/security/krb5JAASLogin.conf already being generated
WARN: /data01/acceldata/work/ad_hdp3_dev/krb/security/kafkaKrb5JAASLogin.conf already being generated
✓ Done, Kerberos setup completed.
INFO: /data01/acceldata/work/ad_hdp3_dev/fsanalytics/kinit_fsimage.sh - ✓ Done
INFO: /data01/acceldata/work/ad_hdp3_dev/fsanalytics/update_fsimage.sh - ✓ Done

Adding Second Cluster

You can follow the steps in the Enable MultiKDC section to add the second cluster.