[AMBARI-16009] Regenerating keytabs on re-imaged hosts results in error during 'Creating Principals'

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.2.2
• Fix Version/s: 2.2.2
• Component/s: ambari-server
• Labels: kerberos
• Assignee: Robert Levas
• Reporter: Robert Levas
• Due: 21/Apr/16
• Created: 21/Apr/16 13:15
• Updated: 21/Apr/16 23:16
• Resolved: 21/Apr/16 18:01

Description

We had a 1600 unsecured cluster initially, from which 700 nodes were destroyed. Though Ambari-server knew of 1600 hosts, only 900 were heartbeating. At this point we secured the cluster and everything was good. Then we brought back the 700 hosts, which started heartbeating with ambari-server.

At this point we did 'Regenerate Keytabs' which failed at the 'Create Principals' step (image attached), as it was trying to re-create principal which is already existing with kadmin, and with ambari-server.

Create Principals
Stderr:

2016-04-21 01:28:52,985 - Failed to create or update principal, HTTP/[e-mail] - Failed to create service principal for HTTP/[e-mail]
STDOUT: Authenticating as principal admin/admin with password.

STDERR: WARNING: no policy specified for HTTP/[e-mail]; defaulting to no policy
add_principal: Principal or policy already exists while creating "HTTP/[e-mail]".

Stdout:

2016-04-21 01:27:32,400 - Processing identities...
2016-04-21 01:28:29,874 - Processing principal, HTTP/[e-mail]

Issue Links

• links to: ReviewBoard