Skip to main content
Version: 3.1.0 (Preview)

Kerberos

Apache Ambari 3.1 supports Kerberos-secured Hadoop clusters through the React installer and service configuration workflows. The UI collects only the credentials and options required for the selected provisioning mode; it does not display or persist secret material as documentation defaults.

Kerberos enablement from KDC validation through protected credentials, background request, restarts, service checks, and recovery

Credentials enter only at the protected step. The descriptor defines identities and keytab paths, never passwords or keytab contents.

Choose A Workflow​

  • Use Enabling Kerberos when installing or securing a cluster. The wizard validates the selected KDC or Active Directory mode, collects required inputs, and records progress for retry.
  • Use Kerberos Descriptor to describe identities, principals, keytabs, services, components, and generated configuration properties in a Stack or service definition.
  • Use Kerberos Service Configuration to understand service-level configuration groups, dependencies, and restart behavior after security changes.

Supported Modes​

The current wizard defines existing MIT KDC, Active Directory, IPA, and manually prepared Kerberos options. The selected mode determines which principal, realm, administrative access, keytab, and distribution fields are required. Cluster administrators remain responsible for KDC policy, DNS, time synchronization, and host enrollment; this does not establish compatibility with unlisted KDC implementations.

Security Boundaries​

KDC administrative credentials are entered through the protected wizard flow and are used for the request that needs them. They must be supplied through the deployment configuration or secret store used by the installation, never committed to a Stack definition or copied into a descriptor example. Keytab contents and passwords are not telemetry, labels, URLs, or ordinary configuration text.

Recovery And Operations​

Kerberos operations are background requests owned by the initiating user. The React UI restores the request checkpoint after refresh or session recovery, reports failures, and allows a supported retry without silently repeating completed steps. A server restart can interrupt a request; inspect its persisted state before retrying. After enabling or changing Kerberos, use the service page to review affected configuration groups and restart requirements.

See the Kerberos Descriptor, Kerberos Service, and Enabling Kerberos pages for the detailed contracts.