You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@ambari.apache.org by Attila Magyar <am...@hortonworks.com> on 2017/01/04 12:42:52 UTC

Review Request 55171: Setup correct authentication and authorization mechanism between Yarn and Zookeeper

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55171/
-----------------------------------------------------------

Review request for Ambari, Attila Doroszlai, Laszlo Puskas, Robert Levas, and Sebastian Toader.


Bugs: AMBARI-19331
    https://issues.apache.org/jira/browse/AMBARI-19331


Repository: ambari


Description
-------

YARN registry and yarn leader election znodes must be protected by sasl ACLs when kerberos enabled. The sasl ACLs should be removed after disabling kerberos.
The yarn registry ACLs can be controlled by "hadoop.registry.secure" configuration option. When this parameter is set to true, yarn will put sasl ACLs on the /registry znodes. These ACLs will be removed during dekerberization.


Diffs
-----

  ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java 15edb69 
  ambari-agent/src/test/java/org/apache/ambari/tools/zk/ZkMigratorTest.java 0a2bbac 
  ambari-common/src/main/python/resource_management/core/resources/zkmigrator.py a946e47 
  ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json a8379ee 
  ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/params_linux.py 53ea4d6 
  ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/resourcemanager.py 3cf5a5b 
  ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/kerberos.json 4cb18a9 
  ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/params_linux.py b79fa1a 
  ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/resourcemanager.py 16670d1 
  ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json 784589c 
  ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/YARN/kerberos.json 74b5746 
  ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json c20bd23 
  ambari-server/src/main/resources/stacks/HDP/2.5/services/YARN/kerberos.json 4cb18a9 

Diff: https://reviews.apache.org/r/55171/diff/


Testing
-------

Testing:
 - Added new unittest to zkmigrator

Manual testing:
 - created a cluster with yarn
 - enabled yarn HA mode
 - enabled yarn registry
 - enabled kerberos
 - checked acls on /registry /yarn-leader-election znodes
 - disabled kerberos
 - checked acls on /registry /yarn-leader-election znodes

Ambari-Server:

Results :	
Tests run: 4833, Failures: 0, Errors: 0, Skipped: 37

----------------------------------------------------------------------
Ran 269 tests in 6.748s

OK
----------------------------------------------------------------------
Total run:1155
Total errors:0
Total failures:0

Ambari-Agent
Ran 452 tests in 11.830s

OK


Thanks,

Attila Magyar


Re: Review Request 55171: Setup correct authentication and authorization mechanism between Yarn and Zookeeper

Posted by Robert Levas <rl...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55171/#review160496
-----------------------------------------------------------


Ship it!




Ship It!

- Robert Levas


On Jan. 4, 2017, 10:10 a.m., Attila Magyar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55171/
> -----------------------------------------------------------
> 
> (Updated Jan. 4, 2017, 10:10 a.m.)
> 
> 
> Review request for Ambari, Attila Doroszlai, Laszlo Puskas, Robert Levas, and Sebastian Toader.
> 
> 
> Bugs: AMBARI-19331
>     https://issues.apache.org/jira/browse/AMBARI-19331
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> YARN registry and yarn leader election znodes must be protected by sasl ACLs when kerberos enabled. The sasl ACLs should be removed after disabling kerberos.
> The yarn registry ACLs can be controlled by "hadoop.registry.secure" configuration option. When this parameter is set to true, yarn will put sasl ACLs on the /registry znodes. These ACLs will be removed during dekerberization.
> 
> 
> Diffs
> -----
> 
>   ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java 15edb69 
>   ambari-agent/src/test/java/org/apache/ambari/tools/zk/ZkMigratorTest.java 0a2bbac 
>   ambari-common/src/main/python/resource_management/core/resources/zkmigrator.py a946e47 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json a8379ee 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/params_linux.py 53ea4d6 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/resourcemanager.py 3cf5a5b 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/kerberos.json 4cb18a9 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/params_linux.py b79fa1a 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/resourcemanager.py 16670d1 
>   ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json 784589c 
>   ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/YARN/kerberos.json 74b5746 
>   ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json c20bd23 
>   ambari-server/src/main/resources/stacks/HDP/2.5/services/YARN/kerberos.json 4cb18a9 
> 
> Diff: https://reviews.apache.org/r/55171/diff/
> 
> 
> Testing
> -------
> 
> Testing:
>  - Added new unittest to zkmigrator
> 
> Manual testing:
>  - created a cluster with yarn
>  - enabled yarn HA mode
>  - enabled yarn registry
>  - enabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
>  - disabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
> 
> Ambari-Server:
> 
> Results :	
> Tests run: 4833, Failures: 0, Errors: 0, Skipped: 37
> 
> ----------------------------------------------------------------------
> Ran 269 tests in 6.748s
> 
> OK
> ----------------------------------------------------------------------
> Total run:1155
> Total errors:0
> Total failures:0
> 
> Ambari-Agent
> Ran 452 tests in 11.830s
> 
> OK
> 
> 
> Thanks,
> 
> Attila Magyar
> 
>


Re: Review Request 55171: Setup correct authentication and authorization mechanism between Yarn and Zookeeper

Posted by Sebastian Toader <st...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55171/#review160495
-----------------------------------------------------------


Ship it!




Ship It!

- Sebastian Toader


On Jan. 4, 2017, 4:10 p.m., Attila Magyar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55171/
> -----------------------------------------------------------
> 
> (Updated Jan. 4, 2017, 4:10 p.m.)
> 
> 
> Review request for Ambari, Attila Doroszlai, Laszlo Puskas, Robert Levas, and Sebastian Toader.
> 
> 
> Bugs: AMBARI-19331
>     https://issues.apache.org/jira/browse/AMBARI-19331
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> YARN registry and yarn leader election znodes must be protected by sasl ACLs when kerberos enabled. The sasl ACLs should be removed after disabling kerberos.
> The yarn registry ACLs can be controlled by "hadoop.registry.secure" configuration option. When this parameter is set to true, yarn will put sasl ACLs on the /registry znodes. These ACLs will be removed during dekerberization.
> 
> 
> Diffs
> -----
> 
>   ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java 15edb69 
>   ambari-agent/src/test/java/org/apache/ambari/tools/zk/ZkMigratorTest.java 0a2bbac 
>   ambari-common/src/main/python/resource_management/core/resources/zkmigrator.py a946e47 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json a8379ee 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/params_linux.py 53ea4d6 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/resourcemanager.py 3cf5a5b 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/kerberos.json 4cb18a9 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/params_linux.py b79fa1a 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/resourcemanager.py 16670d1 
>   ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json 784589c 
>   ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/YARN/kerberos.json 74b5746 
>   ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json c20bd23 
>   ambari-server/src/main/resources/stacks/HDP/2.5/services/YARN/kerberos.json 4cb18a9 
> 
> Diff: https://reviews.apache.org/r/55171/diff/
> 
> 
> Testing
> -------
> 
> Testing:
>  - Added new unittest to zkmigrator
> 
> Manual testing:
>  - created a cluster with yarn
>  - enabled yarn HA mode
>  - enabled yarn registry
>  - enabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
>  - disabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
> 
> Ambari-Server:
> 
> Results :	
> Tests run: 4833, Failures: 0, Errors: 0, Skipped: 37
> 
> ----------------------------------------------------------------------
> Ran 269 tests in 6.748s
> 
> OK
> ----------------------------------------------------------------------
> Total run:1155
> Total errors:0
> Total failures:0
> 
> Ambari-Agent
> Ran 452 tests in 11.830s
> 
> OK
> 
> 
> Thanks,
> 
> Attila Magyar
> 
>


Re: Review Request 55171: Setup correct authentication and authorization mechanism between Yarn and Zookeeper

Posted by Laszlo Puskas <lp...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55171/#review160498
-----------------------------------------------------------


Ship it!




Ship It!

- Laszlo Puskas


On Jan. 4, 2017, 3:10 p.m., Attila Magyar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55171/
> -----------------------------------------------------------
> 
> (Updated Jan. 4, 2017, 3:10 p.m.)
> 
> 
> Review request for Ambari, Attila Doroszlai, Laszlo Puskas, Robert Levas, and Sebastian Toader.
> 
> 
> Bugs: AMBARI-19331
>     https://issues.apache.org/jira/browse/AMBARI-19331
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> YARN registry and yarn leader election znodes must be protected by sasl ACLs when kerberos enabled. The sasl ACLs should be removed after disabling kerberos.
> The yarn registry ACLs can be controlled by "hadoop.registry.secure" configuration option. When this parameter is set to true, yarn will put sasl ACLs on the /registry znodes. These ACLs will be removed during dekerberization.
> 
> 
> Diffs
> -----
> 
>   ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java 15edb69 
>   ambari-agent/src/test/java/org/apache/ambari/tools/zk/ZkMigratorTest.java 0a2bbac 
>   ambari-common/src/main/python/resource_management/core/resources/zkmigrator.py a946e47 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json a8379ee 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/params_linux.py 53ea4d6 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/resourcemanager.py 3cf5a5b 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/kerberos.json 4cb18a9 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/params_linux.py b79fa1a 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/resourcemanager.py 16670d1 
>   ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json 784589c 
>   ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/YARN/kerberos.json 74b5746 
>   ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json c20bd23 
>   ambari-server/src/main/resources/stacks/HDP/2.5/services/YARN/kerberos.json 4cb18a9 
> 
> Diff: https://reviews.apache.org/r/55171/diff/
> 
> 
> Testing
> -------
> 
> Testing:
>  - Added new unittest to zkmigrator
> 
> Manual testing:
>  - created a cluster with yarn
>  - enabled yarn HA mode
>  - enabled yarn registry
>  - enabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
>  - disabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
> 
> Ambari-Server:
> 
> Results :	
> Tests run: 4833, Failures: 0, Errors: 0, Skipped: 37
> 
> ----------------------------------------------------------------------
> Ran 269 tests in 6.748s
> 
> OK
> ----------------------------------------------------------------------
> Total run:1155
> Total errors:0
> Total failures:0
> 
> Ambari-Agent
> Ran 452 tests in 11.830s
> 
> OK
> 
> 
> Thanks,
> 
> Attila Magyar
> 
>


Re: Review Request 55171: Setup correct authentication and authorization mechanism between Yarn and Zookeeper

Posted by Attila Magyar <am...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55171/
-----------------------------------------------------------

(Updated Jan. 4, 2017, 3:10 p.m.)


Review request for Ambari, Attila Doroszlai, Laszlo Puskas, Robert Levas, and Sebastian Toader.


Changes
-------

added more info to failure message


Bugs: AMBARI-19331
    https://issues.apache.org/jira/browse/AMBARI-19331


Repository: ambari


Description
-------

YARN registry and yarn leader election znodes must be protected by sasl ACLs when kerberos enabled. The sasl ACLs should be removed after disabling kerberos.
The yarn registry ACLs can be controlled by "hadoop.registry.secure" configuration option. When this parameter is set to true, yarn will put sasl ACLs on the /registry znodes. These ACLs will be removed during dekerberization.


Diffs (updated)
-----

  ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java 15edb69 
  ambari-agent/src/test/java/org/apache/ambari/tools/zk/ZkMigratorTest.java 0a2bbac 
  ambari-common/src/main/python/resource_management/core/resources/zkmigrator.py a946e47 
  ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json a8379ee 
  ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/params_linux.py 53ea4d6 
  ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/resourcemanager.py 3cf5a5b 
  ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/kerberos.json 4cb18a9 
  ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/params_linux.py b79fa1a 
  ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/resourcemanager.py 16670d1 
  ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json 784589c 
  ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/YARN/kerberos.json 74b5746 
  ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json c20bd23 
  ambari-server/src/main/resources/stacks/HDP/2.5/services/YARN/kerberos.json 4cb18a9 

Diff: https://reviews.apache.org/r/55171/diff/


Testing
-------

Testing:
 - Added new unittest to zkmigrator

Manual testing:
 - created a cluster with yarn
 - enabled yarn HA mode
 - enabled yarn registry
 - enabled kerberos
 - checked acls on /registry /yarn-leader-election znodes
 - disabled kerberos
 - checked acls on /registry /yarn-leader-election znodes

Ambari-Server:

Results :	
Tests run: 4833, Failures: 0, Errors: 0, Skipped: 37

----------------------------------------------------------------------
Ran 269 tests in 6.748s

OK
----------------------------------------------------------------------
Total run:1155
Total errors:0
Total failures:0

Ambari-Agent
Ran 452 tests in 11.830s

OK


Thanks,

Attila Magyar


Re: Review Request 55171: Setup correct authentication and authorization mechanism between Yarn and Zookeeper

Posted by Robert Levas <rl...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55171/#review160491
-----------------------------------------------------------


Ship it!




Ship It!


ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java (line 78)
<https://reviews.apache.org/r/55171/#comment231638>

    Maybe add more info to this message to know that the znode was not found while setting the ACL on it and its children.


- Robert Levas


On Jan. 4, 2017, 7:42 a.m., Attila Magyar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55171/
> -----------------------------------------------------------
> 
> (Updated Jan. 4, 2017, 7:42 a.m.)
> 
> 
> Review request for Ambari, Attila Doroszlai, Laszlo Puskas, Robert Levas, and Sebastian Toader.
> 
> 
> Bugs: AMBARI-19331
>     https://issues.apache.org/jira/browse/AMBARI-19331
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> YARN registry and yarn leader election znodes must be protected by sasl ACLs when kerberos enabled. The sasl ACLs should be removed after disabling kerberos.
> The yarn registry ACLs can be controlled by "hadoop.registry.secure" configuration option. When this parameter is set to true, yarn will put sasl ACLs on the /registry znodes. These ACLs will be removed during dekerberization.
> 
> 
> Diffs
> -----
> 
>   ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java 15edb69 
>   ambari-agent/src/test/java/org/apache/ambari/tools/zk/ZkMigratorTest.java 0a2bbac 
>   ambari-common/src/main/python/resource_management/core/resources/zkmigrator.py a946e47 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json a8379ee 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/params_linux.py 53ea4d6 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/resourcemanager.py 3cf5a5b 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/kerberos.json 4cb18a9 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/params_linux.py b79fa1a 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/resourcemanager.py 16670d1 
>   ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json 784589c 
>   ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/YARN/kerberos.json 74b5746 
>   ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json c20bd23 
>   ambari-server/src/main/resources/stacks/HDP/2.5/services/YARN/kerberos.json 4cb18a9 
> 
> Diff: https://reviews.apache.org/r/55171/diff/
> 
> 
> Testing
> -------
> 
> Testing:
>  - Added new unittest to zkmigrator
> 
> Manual testing:
>  - created a cluster with yarn
>  - enabled yarn HA mode
>  - enabled yarn registry
>  - enabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
>  - disabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
> 
> Ambari-Server:
> 
> Results :	
> Tests run: 4833, Failures: 0, Errors: 0, Skipped: 37
> 
> ----------------------------------------------------------------------
> Ran 269 tests in 6.748s
> 
> OK
> ----------------------------------------------------------------------
> Total run:1155
> Total errors:0
> Total failures:0
> 
> Ambari-Agent
> Ran 452 tests in 11.830s
> 
> OK
> 
> 
> Thanks,
> 
> Attila Magyar
> 
>


Re: Review Request 55171: Setup correct authentication and authorization mechanism between Yarn and Zookeeper

Posted by Sebastian Toader <st...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55171/#review160486
-----------------------------------------------------------


Ship it!




Ship It!

- Sebastian Toader


On Jan. 4, 2017, 1:42 p.m., Attila Magyar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55171/
> -----------------------------------------------------------
> 
> (Updated Jan. 4, 2017, 1:42 p.m.)
> 
> 
> Review request for Ambari, Attila Doroszlai, Laszlo Puskas, Robert Levas, and Sebastian Toader.
> 
> 
> Bugs: AMBARI-19331
>     https://issues.apache.org/jira/browse/AMBARI-19331
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> YARN registry and yarn leader election znodes must be protected by sasl ACLs when kerberos enabled. The sasl ACLs should be removed after disabling kerberos.
> The yarn registry ACLs can be controlled by "hadoop.registry.secure" configuration option. When this parameter is set to true, yarn will put sasl ACLs on the /registry znodes. These ACLs will be removed during dekerberization.
> 
> 
> Diffs
> -----
> 
>   ambari-agent/src/main/java/org/apache/ambari/tools/zk/ZkMigrator.java 15edb69 
>   ambari-agent/src/test/java/org/apache/ambari/tools/zk/ZkMigratorTest.java 0a2bbac 
>   ambari-common/src/main/python/resource_management/core/resources/zkmigrator.py a946e47 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json a8379ee 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/params_linux.py 53ea4d6 
>   ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/package/scripts/resourcemanager.py 3cf5a5b 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/kerberos.json 4cb18a9 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/params_linux.py b79fa1a 
>   ambari-server/src/main/resources/common-services/YARN/3.0.0.3.0/package/scripts/resourcemanager.py 16670d1 
>   ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json 784589c 
>   ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/YARN/kerberos.json 74b5746 
>   ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json c20bd23 
>   ambari-server/src/main/resources/stacks/HDP/2.5/services/YARN/kerberos.json 4cb18a9 
> 
> Diff: https://reviews.apache.org/r/55171/diff/
> 
> 
> Testing
> -------
> 
> Testing:
>  - Added new unittest to zkmigrator
> 
> Manual testing:
>  - created a cluster with yarn
>  - enabled yarn HA mode
>  - enabled yarn registry
>  - enabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
>  - disabled kerberos
>  - checked acls on /registry /yarn-leader-election znodes
> 
> Ambari-Server:
> 
> Results :	
> Tests run: 4833, Failures: 0, Errors: 0, Skipped: 37
> 
> ----------------------------------------------------------------------
> Ran 269 tests in 6.748s
> 
> OK
> ----------------------------------------------------------------------
> Total run:1155
> Total errors:0
> Total failures:0
> 
> Ambari-Agent
> Ran 452 tests in 11.830s
> 
> OK
> 
> 
> Thanks,
> 
> Attila Magyar
> 
>