How to setup multiple KDCs through Cloudera Manager

Currently Cloudera Manager does not support setting up multiple KDCs for the krb5.conf file natively, this article explains the workarounds we can have using the existing feature provided by Cloudera Manager. This article also assumes that you have krb5.conf file managed by Cloudera Manager. If you are using Cloudera Manager prior to 5.7, following the steps below:

1. Go to CM > Administration > Settings > click on “Kerberos” on Filters on the left side > locate “KDC Server Host”, enter the KDC host in the text field:

   kdc-host1.com
   

2. On the same page, locate “Advanced Configuration Snippet (Safety Valve) for the Default Realm in krb5.conf”, and enter the following into the text area:

   kdc = kdc-host2.com
   

3. Save and then “Deploy Kerberos Client Configuration” (you might need to stop all service first before you can do this) The [realm] section in the krb5.conf will be updated like below:

   [realms]
   TEST.COM = {
   kdc = kdc-host1.com
   admin_server = kdc-host1.com
   kdc = kdc-host2.com
   }
   

If you are using CM5.7 and above, you can also do the following (above steps should still work):

1. Go to CM > Administration > Settings > click on “Kerberos” on Filters on the left side > locate “KDC Server Host”, empty the KDC host in the text field, so that it contains no value
2. On the same page, locate “Advanced Configuration Snippet (Safety Valve) for the Default Realm in krb5.conf”, and enter the following into the text area:

   kdc = kdc-host1.com
   kdc = kdc-host2.com
   admin_server = kdc-host1.com
   

3. Save and then “Deploy Kerberos Client Configuration” (you might need to stop all service first before you can do this) The [realm] section in the krb5.conf will be updated like below:

   [realms]
   TEST.COM = {
   kdc = kdc-host1.com
   kdc = kdc-host2.com
   admin_server = kdc-host1.com
   }
   

The second option does not work prior to CM5.7 is because the older version of CM will generate the following line in krb5.conf if the KDC Server Host is empty:

kdc =

which will break the syntax in krb5.conf file.