[AMBARI-21767] Kerberos cluster - hive service check failed post migration

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Cannot Reproduce
• Affects Version/s: 2.5.2
• Fix Version/s: 2.5.2
• Component/s: ambari-server
• Assignee: Robert Levas
• Reporter: Di Li
• Created: 21/Aug/17 15:46
• Updated: 22/Aug/17 18:17
• Resolved: 22/Aug/17 18:17

Description

Post migration hive service check failed with following error:

Templeton Smoke Test (ddl cmd): Failed. :

{"error":"User: HTTP/[e-mail] is not allowed to impersonate ambari-qa"}

http_code <500>
2017-08-18 09:51:50,109 - Retrying after 5 seconds. Reason: Execution of '/var/lib/ambari-agent/tmp/templetonSmoke.sh mmk-m-2.fyre.ibm.com ambari-qa 50111 idtest.ambari-qa.1503075103.65.pig /etc/security/keytabs/smokeuser.headless.keytab true /usr/bin/kinit [e-mail] /var/lib/ambari-agent/tmp' returned 1. Templeton Smoke Test (ddl cmd): Failed. :

{"error":"User: HTTP/[e-mail] is not allowed to impersonate ambari-qa"}

http_code <500>
Templeton Smoke Test (ddl cmd): Failed. :

{"error":"User: HTTP/[e-mail] is not allowed to impersonate ambari-qa"}

http_code <500>

WORKAROUND:
Shailaja suggested to modify all the entries in custom core-site property under HDFS service to * and also add hbase. I added hbase key value pair as following:
hadoop.proxyuser.hbase.groups *     
hadoop.proxyuser.hbase.hosts *

Also modified following properties:
hadoop.proxyuser.hcat.hosts was mmk-m-2.fyre.ibm.com modified to *
hadoop.proxyuser.HTTP.hosts was mmk-m-2.fyre.ibm.com modified to *
hadoop.proxyuser.yarn.hosts was mmk-m-2.fyre.ibm.com modified to *
hadoop.proxyuser.knox.groups was users modified to *
hadoop.proxyuser.HTTP.groups was users modified to *
hadoop.proxyuser.root.hosts was mmk-m-1.fyre.ibm.com modified to *

After that hive service check passed. If this work around is not done bigsql upgrade will fail during service check. This step is not documented.