You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ambari.apache.org by dm...@apache.org on 2016/06/01 15:26:24 UTC

[41/94] ambari git commit: AMBARI-16272. Ambari Upgrade shouldn't automatically add stack configs (dlysnichenko)

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml b/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml
index 1b26644..0314f0a 100644
--- a/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml
+++ b/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml
@@ -19,7 +19,6 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_adding_forbidden="true">
   <property>
     <name>oozie_user</name>
@@ -31,11 +30,15 @@
       <type>user</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_admin_users</name>
     <value>{oozie_user}, oozie-admin</value>
     <description>Oozie admin users.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_database</name>
@@ -45,6 +48,8 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_data_dir</name>
@@ -56,6 +61,8 @@
       <empty-value-valid>true</empty-value-valid>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_log_dir</name>
@@ -66,6 +73,8 @@
       <type>directory</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_tmp_dir</name>
@@ -76,6 +85,8 @@
       <type>directory</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_pid_dir</name>
@@ -87,6 +98,8 @@
       <editable-only-at-install>true</editable-only-at-install>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_admin_port</name>
@@ -97,28 +110,37 @@
       <overridable>false</overridable>
       <type>int</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_heapsize</name>
     <value>2048</value>
     <description>Oozie heap size.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_permsize</name>
     <value>256</value>
     <description>Oozie permanent generation size.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_user_nofile_limit</name>
     <value>32000</value>
     <description>Max open files limit setting for OOZIE user.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie_user_nproc_limit</name>
     <value>16000</value>
     <description>Max number of processes limit setting for OOZIE user.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <!-- oozie-env.sh -->
   <property>
     <name>content</name>
@@ -189,9 +211,10 @@ export OOZIE_ADMIN_PORT={{oozie_server_admin_port}}
 # export OOZIE_BASE_URL="http://${OOZIE_HTTP_HOSTNAME}:${OOZIE_HTTP_PORT}/oozie"
 export JAVA_LIBRARY_PATH={{hadoop_lib_home}}/native/Linux-amd64-64
    </value>
-   <value-attributes>
-     <type>content</type>
-   </value-attributes>
+    <value-attributes>
+      <type>content</type>
+    </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-log4j.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-log4j.xml b/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-log4j.xml
index 7e77b8c..754770e 100644
--- a/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-log4j.xml
+++ b/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-log4j.xml
@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_final="false" supports_adding_forbidden="true">
-
   <property>
     <name>content</name>
     <display-name>oozie-log4j template</display-name>
@@ -111,6 +109,7 @@ log4j.logger.org.apache.hadoop.security.authentication.server=WARN, oozie
       <type>content</type>
       <show-property-name>false</show-property-name>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-site.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-site.xml b/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-site.xml
index 4a8e60c..ca0fae7 100644
--- a/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-site.xml
+++ b/ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-site.xml
@@ -16,9 +16,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-
 <configuration supports_final="true">
-
   <!--
       Refer to the oozie-default.xml file for the complete list of
       Oozie configuration properties and their default values.
@@ -28,24 +26,27 @@
     <value>http://localhost:11000/oozie</value>
     <property-type>DONT_ADD_ON_UPGRADE</property-type>
     <description>Base Oozie URL.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.system.id</name>
     <value>oozie-${user.name}</value>
     <description>
       The Oozie system ID.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.systemmode</name>
     <value>NORMAL</value>
     <description>
       System mode for Oozie at startup.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.AuthorizationService.security.enabled</name>
     <value>true</value>
@@ -53,36 +54,41 @@
       Specifies whether security (user name/admin role) is enabled or not.
       If disabled any user can manage Oozie system and manage any job.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.PurgeService.older.than</name>
     <value>30</value>
     <description>
       Jobs older than this value, in days, will be purged by the PurgeService.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.PurgeService.purge.interval</name>
     <value>3600</value>
     <description>
       Interval at which the purge service will run, in seconds.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.CallableQueueService.queue.size</name>
     <value>1000</value>
     <description>Max callable queue size</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.CallableQueueService.threads</name>
     <value>10</value>
     <description>Number of threads used for executing callables</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.CallableQueueService.callable.concurrency</name>
     <value>3</value>
@@ -93,16 +99,18 @@
       All commands that use action executors (action-start, action-end, action-kill and action-check) use
       the action type as the callable type.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.coord.normal.default.timeout</name>
     <value>120</value>
     <description>Default timeout for a coordinator action input check (in minutes) for normal job.
       -1 means infinite timeout
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.db.schema.name</name>
     <display-name>Database Name</display-name>
@@ -114,8 +122,9 @@
       <type>database</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.authentication.type</name>
     <value>simple</value>
@@ -123,8 +132,9 @@
       Authentication used for Oozie HTTP endpoint, the supported values are: simple | kerberos |
       #AUTHENTICATION_HANDLER_CLASSNAME#.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.WorkflowAppService.system.libpath</name>
     <value>/user/${user.name}/share/lib</value>
@@ -133,8 +143,9 @@
       This path is added to workflow application if their job properties sets
       the property 'oozie.use.system.libpath' to true.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>use.system.libpath.for.mapreduce.and.pig.jobs</name>
     <value>false</value>
@@ -144,10 +155,14 @@
       specify where the Pig JAR files are. Instead, the ones from the system
       library path are used.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.authentication.kerberos.name.rules</name>
     <description>The mapping from kerberos principal names to local OS user names.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.service.HadoopAccessorService.hadoop.configurations</name>
@@ -160,6 +175,8 @@
       the Oozie configuration directory; though the path can be absolute (i.e. to point
       to Hadoop client conf/ directories in the local filesystem.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.service.ActionService.executor.ext.classes</name>
@@ -175,8 +192,9 @@
       be used in workflows. This property is a convenience property to add extensions to the built in executors without
       having to include all the built in ones.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.SchemaService.wf.ext.schemas</name>
     <value>shell-action-0.1.xsd,email-action-0.1.xsd,hive-action-0.2.xsd,sqoop-action-0.2.xsd,ssh-action-0.1.xsd,distcp-action-0.1.xsd,shell-action-0.2.xsd,oozie-sla-0.1.xsd,oozie-sla-0.2.xsd,hive-action-0.3.xsd</value>
@@ -184,6 +202,8 @@
       Schemas for additional actions types. IMPORTANT: if there are no schemas leave a 1 space string, the service
       trims the value, if empty Configuration assumes it is NULL.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.service.JPAService.create.db.schema</name>
@@ -194,8 +214,9 @@
       If set to true, it creates the DB schema if it does not exist. If the DB schema exists is a NOP.
       If set to false, it does not create the DB schema. If the DB schema does not exist it fails start up.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.JPAService.jdbc.driver</name>
     <value>org.apache.derby.jdbc.EmbeddedDriver</value>
@@ -206,8 +227,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.JPAService.jdbc.url</name>
     <value>jdbc:derby:${oozie.data.dir}/${oozie.db.schema.name}-db;create=true</value>
@@ -218,8 +240,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.JPAService.jdbc.username</name>
     <value>oozie</value>
@@ -231,11 +254,12 @@
       <type>db_user</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
-  <property require-input = "true">
+  <property require-input="true">
     <name>oozie.service.JPAService.jdbc.password</name>
-    <value></value>
+    <value/>
     <display-name>Database Password</display-name>
     <property-type>PASSWORD</property-type>
     <description>
@@ -248,16 +272,18 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.JPAService.pool.max.active.conn</name>
     <value>10</value>
     <description>
       Max number of connections.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.services</name>
     <value>
@@ -294,6 +320,8 @@
       org.apache.oozie.service.ProxyUserService
     </value>
     <description>List of Oozie services</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.service.HadoopAccessorService.kerberos.enabled</name>
@@ -301,6 +329,8 @@
     <description>
        Indicates if Oozie is configured to use Kerberos.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.service.URIHandlerService.uri.handlers</name>
@@ -308,6 +338,8 @@
     <description>
       Enlist the different uri handlers supported for data availability checks.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.services.ext</name>
@@ -317,6 +349,8 @@
       To add/replace services defined in 'oozie.services' with custom implementations.
       Class names must be separated by commas.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.service.coord.push.check.requeue.interval</name>
@@ -324,6 +358,8 @@
     <description>
       Command re-queue interval for push dependencies (in millisecond).
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>oozie.credentials.credentialclasses</name>
@@ -331,6 +367,7 @@
     <description>
       Credential Class to be used for HCat.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-env.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-env.xml b/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-env.xml
index 705f830..4d11c26 100644
--- a/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-env.xml
+++ b/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-env.xml
@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_adding_forbidden="true">
-
   <!-- oozie-env.sh -->
   <property>
     <name>content</name>
@@ -104,6 +102,7 @@ export JAVA_LIBRARY_PATH="$JAVA_LIBRARY_PATH:{{jdbc_libs_dir}}"
     <value-attributes>
       <type>content</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-log4j.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-log4j.xml b/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-log4j.xml
index 4b28116..1c9d6bb 100644
--- a/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-log4j.xml
+++ b/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-log4j.xml
@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_final="false" supports_adding_forbidden="true">
-
   <property>
     <name>content</name>
     <display-name>oozie-log4j template</display-name>
@@ -134,6 +132,7 @@ log4j.logger.org.apache.hadoop.security.authentication.server=WARN, oozie
       <type>content</type>
       <show-property-name>false</show-property-name>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-site.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-site.xml b/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-site.xml
index 107816d..4036420 100644
--- a/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-site.xml
+++ b/ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/configuration/oozie-site.xml
@@ -17,12 +17,12 @@
 ~ limitations under the License.
 -->
 <configuration supports_final="true" supports_do_not_extend="true">
-
   <property>
     <name>oozie.authentication.kerberos.name.rules</name>
     <description>The mapping from kerberos principal names to local OS user names.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.authentication.type</name>
     <value>simple</value>
@@ -30,23 +30,26 @@
       Authentication used for Oozie HTTP endpoint, the supported values are: simple | kerberos |
       #AUTHENTICATION_HANDLER_CLASSNAME#.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.base.url</name>
     <value>http://localhost:11000/oozie</value>
     <property-type>DONT_ADD_ON_UPGRADE</property-type>
     <description>Base Oozie URL.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.credentials.credentialclasses</name>
     <value>hcat=org.apache.oozie.action.hadoop.HCatCredentials,hive2=org.apache.oozie.action.hadoop.Hive2Credentials</value>
     <description>
       Credential Class to be used for HCat.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.HadoopAccessorService.hadoop.configurations</name>
     <value>*={{hadoop_conf_dir}}</value>
@@ -58,16 +61,18 @@
       the Oozie configuration directory; though the path can be absolute (i.e. to point
       to Hadoop client conf/ directories in the local filesystem.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.HadoopAccessorService.kerberos.enabled</name>
     <value>false</value>
     <description>
       Indicates if Oozie is configured to use Kerberos.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.URIHandlerService.uri.handlers</name>
     <value>org.apache.oozie.dependency.FSURIHandler,org.apache.oozie.dependency.HCatURIHandler
@@ -75,8 +80,9 @@
     <description>
       Enlist the different uri handlers supported for data availability checks.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.services.ext</name>
     <value>
@@ -86,8 +92,9 @@
       To add/replace services defined in 'oozie.services' with custom implementations.
       Class names must be separated by commas.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.db.schema.name</name>
     <value>oozie</value>
@@ -99,8 +106,9 @@
       <type>database</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.JPAService.jdbc.username</name>
     <value>oozie</value>
@@ -112,11 +120,12 @@
       <type>db_user</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property require-input="true">
     <name>oozie.service.JPAService.jdbc.password</name>
-    <value></value>
+    <value/>
     <display-name>Database Password</display-name>
     <property-type>PASSWORD</property-type>
     <description>
@@ -129,8 +138,9 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.JPAService.jdbc.driver</name>
     <value>org.apache.derby.jdbc.EmbeddedDriver</value>
@@ -147,8 +157,9 @@
         <name>oozie_database</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.JPAService.jdbc.url</name>
     <value>jdbc:derby:${oozie.data.dir}/${oozie.db.schema.name}-db;create=true</value>
@@ -169,8 +180,9 @@
         <name>oozie.db.schema.name</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.service.AuthorizationService.security.enabled</name>
     <value>true</value>
@@ -178,14 +190,16 @@
       Specifies whether security (user name/admin role) is enabled or not.
       If disabled any user can manage Oozie system and manage any job.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>oozie.authentication.simple.anonymous.allowed</name>
     <value>true</value>
     <description>
       Indicates if anonymous requests are allowed when using 'simple' authentication.
     </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-env.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-env.xml b/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-env.xml
index cc4a790..f654c30 100644
--- a/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-env.xml
+++ b/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-env.xml
@@ -19,7 +19,6 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_adding_forbidden="true">
   <!-- pig-env.sh -->
   <property>
@@ -37,6 +36,7 @@ fi
     <value-attributes>
       <type>content</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-  
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-log4j.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-log4j.xml b/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-log4j.xml
index fd2d8aa..a5c908c 100644
--- a/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-log4j.xml
+++ b/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-log4j.xml
@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_final="false" supports_adding_forbidden="true">
-
   <property>
     <name>content</name>
     <display-name>pig-log4j template</display-name>
@@ -62,6 +60,7 @@ log4j.appender.A.layout.ConversionPattern=%-4r [%t] %-5p %c %x - %m%n
       <type>content</type>
       <show-property-name>false</show-property-name>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-properties.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-properties.xml b/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-properties.xml
index 2ef0639..60b6cae 100644
--- a/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-properties.xml
+++ b/ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/configuration/pig-properties.xml
@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_final="false" supports_adding_forbidden="true">
-
   <property>
     <name>content</name>
     <display-name>pig-properties template</display-name>
@@ -90,6 +88,7 @@ hcat.bin=/usr/bin/hcat
       <empty-value-valid>true</empty-value-valid>
       <show-property-name>false</show-property-name>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-profiles.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-profiles.xml b/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-profiles.xml
index 442fe4a..1f8d85a 100644
--- a/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-profiles.xml
+++ b/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-profiles.xml
@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_final="false" supports_adding_forbidden="true">
-
   <property>
     <name>content</name>
     <display-name>pxf-profiles template</display-name>
@@ -160,11 +158,11 @@ under the License.
         </plugins>
     </profile>
 </profiles>
-    ]]>
-    </value>
+    ]]></value>
     <value-attributes>
       <show-property-name>false</show-property-name>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-public-classpath.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-public-classpath.xml b/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-public-classpath.xml
index 59183fb..d28286a 100644
--- a/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-public-classpath.xml
+++ b/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-public-classpath.xml
@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 -->
-
 <configuration supports_final="false" supports_adding_forbidden="true">
-
   <property>
     <name>content</name>
     <display-name>pxf-public-classpath template</display-name>
@@ -59,6 +57,7 @@
     <value-attributes>
       <show-property-name>false</show-property-name>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-site.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-site.xml b/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-site.xml
index 8ebd23e..eaebbf1 100644
--- a/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-site.xml
+++ b/ambari-server/src/main/resources/common-services/PXF/3.0.0/configuration/pxf-site.xml
@@ -15,12 +15,14 @@
    See the License for the specific language governing permissions and
    limitations under the License.
 -->
-<configuration> 
-	<property>
-		<name>pxf.service.kerberos.keytab</name>
-		<value>/etc/security/keytabs/pxf.service.keytab</value>
-		<description>
+<configuration>
+  <property>
+    <name>pxf.service.kerberos.keytab</name>
+    <value>/etc/security/keytabs/pxf.service.keytab</value>
+    <description>
 		  Path to the PXF keytab file, owned by PXF service and with permissions 0400.
 		</description>
-	</property>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/admin-properties.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/admin-properties.xml b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/admin-properties.xml
index 6439a7e..fe1f95c 100644
--- a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/admin-properties.xml
+++ b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/admin-properties.xml
@@ -20,7 +20,6 @@
  */
 -->
 <configuration supports_final="false">
-
   <property>
     <name>DB_FLAVOR</name>
     <value>MYSQL</value>
@@ -41,8 +40,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>SQL_COMMAND_INVOKER</name>
     <value>mysql</value>
@@ -51,8 +51,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>SQL_CONNECTOR_JAR</name>
     <value>{{driver_curl_target}}</value>
@@ -67,8 +68,9 @@
         <name>DB_FLAVOR</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>db_root_user</name>
     <value>root</value>
@@ -77,11 +79,12 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property require-input="true">
     <name>db_root_password</name>
-    <value></value>
+    <value/>
     <property-type>PASSWORD</property-type>
     <display-name>Database Administrator (DBA) password</display-name>
     <description>Database password for the database admin username</description>
@@ -89,18 +92,20 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>db_host</name>
-    <value></value>
+    <value/>
     <display-name>Ranger DB host</display-name>
     <description>Database host</description>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>db_name</name>
     <value>ranger</value>
@@ -109,8 +114,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>db_user</name>
     <value>rangeradmin</value>
@@ -119,11 +125,12 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property require-input="true">
     <name>db_password</name>
-    <value></value>
+    <value/>
     <property-type>PASSWORD</property-type>
     <display-name>Ranger DB password</display-name>
     <description>Database password for the Ranger schema</description>
@@ -131,8 +138,9 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>audit_db_name</name>
     <value>ranger_audit</value>
@@ -141,8 +149,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>audit_db_user</name>
     <value>rangerlogger</value>
@@ -151,11 +160,12 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property require-input="true">
     <name>audit_db_password</name>
-    <value></value>
+    <value/>
     <property-type>PASSWORD</property-type>
     <display-name>Ranger Audit DB password</display-name>
     <description>Database password for storing auditlog information</description>
@@ -163,11 +173,12 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>policymgr_external_url</name>
-    <value></value>
+    <value/>
     <display-name>External URL</display-name>
     <description>Policy Manager external url eg: http://RANGER_HOST:6080</description>
     <value-attributes>
@@ -187,8 +198,9 @@
         <name>https.service.port</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>policymgr_http_enabled</name>
     <value>true</value>
@@ -197,13 +209,14 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>authentication_method</name>
     <value>UNIX</value>
     <display-name>Authentication method</display-name>
-    <description></description>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
@@ -213,92 +226,103 @@
         <name>SYNC_SOURCE</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>remoteLoginEnabled</name>
     <value>true</value>
     <display-name>Allow remote Login</display-name>
-    <description></description>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>authServiceHostName</name>
     <value>localhost</value>
-    <description></description>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>authServicePort</name>
     <value>5151</value>
-    <description></description>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_url</name>
     <value>"ldap://71.127.43.33:389"</value>
-    <description></description>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_userDNpattern</name>
     <value>"uid={0},ou=users,dc=xasecure,dc=net"</value>
-    <description></description>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_groupSearchBase</name>
     <value>"ou=groups,dc=xasecure,dc=net"</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_groupSearchFilter</name>
     <value>"(member=uid={0},ou=users,dc=xasecure,dc=net)"</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_groupRoleAttribute</name>
     <value>"cn"</value>
-    <description></description>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_ad_domain</name>
     <display-name>Domain Name (AD specific)</display-name>
-    <value></value>
+    <value/>
     <description>AD domain, only used if Authentication method is AD</description>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_ad_url</name>
-    <value></value>
-    <description></description>
+    <value/>
+    <description/>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-env.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-env.xml b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-env.xml
index b436b75..99fe6dc 100644
--- a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-env.xml
+++ b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-env.xml
@@ -19,7 +19,6 @@
  */
 -->
 <configuration supports_final="true" supports_adding_forbidden="true">
-
   <property>
     <name>ranger_user</name>
     <value>ranger</value>
@@ -30,8 +29,9 @@
       <type>user</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger_group</name>
     <value>ranger</value>
@@ -42,41 +42,45 @@
       <type>user</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger_admin_log_dir</name>
     <value>/var/log/ranger/admin</value>
-    <description></description>
+    <description/>
     <value-attributes>
       <type>directory</type>
       <overridable>false</overridable>
       <editable-only-at-install>true</editable-only-at-install>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger_usersync_log_dir</name>
     <value>/var/log/ranger/usersync</value>
-    <description></description>
+    <description/>
     <value-attributes>
       <type>directory</type>
       <overridable>false</overridable>
       <editable-only-at-install>true</editable-only-at-install>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger_admin_username</name>
     <value>amb_ranger_admin</value>
     <property-type>TEXT</property-type>
     <display-name>Ranger Admin username for Ambari</display-name>
     <description>This is the ambari user created for creating repositories and policies in Ranger Admin for each plugin</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger_admin_password</name>
-    <value></value>
+    <value/>
     <property-type>PASSWORD</property-type>
     <display-name>Ranger Admin user's password for Ambari</display-name>
     <description>This is the ambari user password created for creating repositories and policies in Ranger Admin for each plugin</description>
@@ -84,14 +88,16 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>admin_username</name>
     <value>admin</value>
     <description>This is the username for default admin user that is used for creating ambari user in Ranger Admin</description>
-  </property>  
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>admin_password</name>
     <value>admin</value>
@@ -100,27 +106,31 @@
     <value-attributes>
       <type>password</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-  
   <property>
     <name>oracle_home</name>
     <value>-</value>
     <property-type>TEXT</property-type>
     <description>Oracle Home needs to be set to path where oracle is installed, this will help install Ranger Admin when used with Oracle as database.</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xml_configurations_supported</name>
     <value>false</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger_pid_dir</name>
     <value>/var/run/ranger</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger-hdfs-plugin-enabled</name>
     <value>No</value>
@@ -141,8 +151,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger-hive-plugin-enabled</name>
     <value>No</value>
@@ -163,8 +174,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger-hbase-plugin-enabled</name>
     <value>No</value>
@@ -185,8 +197,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger-storm-plugin-enabled</name>
     <value>No</value>
@@ -207,8 +220,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger-knox-plugin-enabled</name>
     <value>No</value>
@@ -229,8 +243,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>bind_anonymous</name>
     <display-name>Bind Anonymous</display-name>
@@ -251,8 +266,9 @@
       <selection-cardinality>1</selection-cardinality>
       <empty-value-valid>true</empty-value-valid>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xasecure.audit.destination.hdfs</name>
     <value>false</value>
@@ -273,8 +289,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xasecure.audit.destination.hdfs.dir</name>
     <value>hdfs://localhost:8020/ranger/audit/%app-type%/%time:yyyyMMdd%</value>
@@ -287,8 +304,9 @@
         <name>fs.defaultFS</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xasecure.audit.destination.db</name>
     <value>true</value>
@@ -309,6 +327,7 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-site.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-site.xml b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-site.xml
index daab4ec..b65ac91 100644
--- a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-site.xml
+++ b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-site.xml
@@ -20,48 +20,54 @@
  */
 -->
 <configuration supports_final="false">
-
   <property>
     <name>http.service.port</name>
     <value>6080</value>
     <description>The http port to be used</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>https.service.port</name>
     <value>6182</value>
     <description>The secured https port to be used</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>https.attrib.keystoreFile</name>
     <value>/etc/ranger/admin/keys/server.jks</value>
     <description>The keystore file location</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>https.attrib.keystorePass</name>
     <value>xasecure</value>
     <property-type>PASSWORD</property-type>
     <description>The keystore pass to be used </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>https.attrib.keyAlias</name>
     <value>myKey</value>
     <description>The key alias to be used </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>https.attrib.clientAuth</name>
     <value>want</value>
     <description>The client auth to be used </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>http.enabled</name>
     <value>true</value>
     <description>http enabled or https enabled </description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
-</configuration>
\ No newline at end of file
+</configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/usersync-properties.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/usersync-properties.xml b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/usersync-properties.xml
index c7dbdb6..ed2fec6 100644
--- a/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/usersync-properties.xml
+++ b/ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/usersync-properties.xml
@@ -40,102 +40,136 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>MIN_UNIX_USER_ID_TO_SYNC</name>
     <display-name>Minimum User ID</display-name>
     <value>1000</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>POLICY_MGR_URL</name>
     <value>{{usersync_exturl}}</value>
     <description>Policy Manager external url</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_INTERVAL</name>
     <value>1</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_URL</name>
     <display-name>LDAP (AD) URL</display-name>
-    <value></value>
+    <value/>
     <description>LDAP server URL. Example value = ldap://localhost:389</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_BIND_DN</name>
     <display-name>\u200bBind User</display-name>
-    <value></value>
+    <value/>
     <description>Full distinguished name (DN), including common name (CN), of an LDAP user account that has privileges to search for users. Example: cn=admin,ou=users,dc=hadoop,dc=apache,dc-org</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_BIND_PASSWORD</name>
     <display-name>Bind User Password</display-name>
-    <value></value>
+    <value/>
     <property-type>PASSWORD</property-type>
-    <description></description>
+    <description/>
     <value-attributes>
       <type>password</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>CRED_KEYSTORE_FILENAME</name>
     <value>/usr/lib/xausersync/.jceks/xausersync.jceks</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_USER_SEARCH_BASE</name>
     <display-name>User Search Base</display-name>
-    <value></value>
+    <value/>
     <description>sample value would be ou=users,dc=hadoop,dc=apache,dc=org</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_USER_SEARCH_SCOPE</name>
     <display-name>User Search Scope</display-name>
     <value>sub</value>
     <description>default value: sub</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_USER_OBJECT_CLASS</name>
     <display-name>User Object Class\u200b</display-name>
     <value>person</value>
     <description>default value: person</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_USER_SEARCH_FILTER</name>
     <display-name>\u200bUser Search Filter</display-name>
-    <value></value>
+    <value/>
     <description>default value is empty</description>
     <value-attributes>
       <empty-value-valid>true</empty-value-valid>
-    </value-attributes>  
+    </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_USER_NAME_ATTRIBUTE</name>
     <display-name>Username Attribute</display-name>
     <value>cn</value>
     <description>default value: cn</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_USER_GROUP_NAME_ATTRIBUTE</name>
     <display-name>User Group Name Attribute</display-name>
     <value>memberof,ismemberof</value>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_USERNAME_CASE_CONVERSION</name>
     <value>none</value>
     <description>possible values:  none, lower, upper</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>SYNC_LDAP_GROUPNAME_CASE_CONVERSION</name>
     <value>none</value>
     <description>possible values:  none, lower, upper</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
   <property>
     <name>logdir</name>
     <value>logs</value>
     <description>user sync log path</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-</configuration>
\ No newline at end of file
+</configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/admin-properties.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/admin-properties.xml b/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/admin-properties.xml
index 7203ed1..cd0304a 100644
--- a/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/admin-properties.xml
+++ b/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/admin-properties.xml
@@ -20,7 +20,6 @@
  */
 -->
 <configuration supports_final="false">
-
   <property>
     <name>DB_FLAVOR</name>
     <value>MYSQL</value>
@@ -53,11 +52,12 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>policymgr_external_url</name>
-    <value></value>
+    <value/>
     <display-name>External URL</display-name>
     <description>Policy Manager external url eg: http://RANGER_HOST:6080</description>
     <value-attributes>
@@ -77,71 +77,85 @@
         <name>ranger.service.https.port</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>policymgr_http_enabled</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>authentication_method</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>remoteLoginEnabled</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>authServiceHostName</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>authServicePort</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_url</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_userDNpattern</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_groupSearchBase</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_groupSearchFilter</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_groupRoleAttribute</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_ad_domain</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>xa_ldap_ad_url</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>SQL_COMMAND_INVOKER</name>
     <deleted>true</deleted>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>

http://git-wip-us.apache.org/repos/asf/ambari/blob/6f855d53/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/ranger-admin-site.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/ranger-admin-site.xml b/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/ranger-admin-site.xml
index b358f27..ef57bc3 100644
--- a/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/ranger-admin-site.xml
+++ b/ambari-server/src/main/resources/common-services/RANGER/0.5.0/configuration/ranger-admin-site.xml
@@ -15,15 +15,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-
 <configuration supports_final="true">
-
   <property>
     <name>ranger.service.host</name>
     <value>{{ranger_host}}</value>
     <description>Host where ranger service to be installed</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.service.http.enabled</name>
     <value>true</value>
@@ -33,38 +32,44 @@
       <overridable>false</overridable>
       <type>boolean</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.service.http.port</name>
     <value>6080</value>
     <description>HTTP port</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.service.https.port</name>
     <value>6182</value>
     <description>HTTPS port (if SSL is enabled)</description>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.service.https.attrib.ssl.enabled</name>
     <value>false</value>
     <description>true/false, set to true if using SSL</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.service.https.attrib.clientAuth</name>
     <value>want</value>
     <description>Needs to be set to want for two way SSL</description>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.service.https.attrib.keystore.keyalias</name>
     <value>rangeradmin</value>
     <description>Alias for Ranger Admin key in keystore</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.service.https.attrib.keystore.pass</name>
     <value>xasecure</value>
@@ -73,14 +78,16 @@
     <value-attributes>
       <type>password</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.https.attrib.keystore.file</name>
     <value>/etc/ranger/admin/conf/ranger-admin-keystore.jks</value>
     <description>Ranger admin keystore (specify full path)</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.externalurl</name>
     <value>{{ranger_external_url}}</value>
@@ -90,8 +97,9 @@
       <visible>false</visible>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.jdbc.driver</name>
     <value>com.mysql.jdbc.Driver</value>
@@ -106,8 +114,9 @@
         <name>DB_FLAVOR</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.jdbc.url</name>
     <value>jdbc:mysql://localhost</value>
@@ -130,14 +139,16 @@
         <name>db_name</name>
       </property>
     </depends-on>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.jpa.jdbc.user</name>
     <value>{{ranger_db_user}}</value>
     <description>JDBC user</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.jdbc.password</name>
     <value>_</value>
@@ -146,20 +157,23 @@
     <value-attributes>
       <type>password</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.jdbc.credential.alias</name>
     <value>rangeradmin</value>
     <description>Alias name for storing JDBC password</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.credential.provider.path</name>
     <value>/etc/ranger/admin/rangeradmin.jceks</value>
     <description>File for credential store, provide full file path</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.audit.source.type</name>
     <value>solr</value>
@@ -174,14 +188,16 @@
         <name>xasecure.audit.destination.db</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.audit.solr.urls</name>
-    <value></value>
+    <value/>
     <description>Solr url for audit. Example: http://solr_host:6083/solr/ranger_audits</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.authentication.method</name>
     <value>UNIX</value>
@@ -196,8 +212,9 @@
         <name>ranger.usersync.source.impl.class</name>
       </property>
     </depends-on>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.url</name>
     <display-name>\u200bLDAP URL</display-name>
@@ -206,8 +223,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.ldap.user.dnpattern</name>
     <value>uid={0},ou=users,dc=xasecure,dc=net</value>
@@ -215,22 +233,25 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.group.searchbase</name>
     <display-name>Group Search Base</display-name>
     <value>{{ranger_ug_ldap_group_searchbase}}</value>
     <description>LDAP group searchbase, only used if Authentication method is LDAP</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.group.searchfilter</name>
     <display-name>Group Search Filter</display-name>
     <value>{{ranger_ug_ldap_group_searchfilter}}</value>
     <description>LDAP group search filter, only used if Authentication method is LDAP</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.user.searchfilter</name>
     <display-name>User Search Filter</display-name>
@@ -239,8 +260,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.group.roleattribute</name>
     <value>cn</value>
@@ -248,8 +270,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.base.dn</name>
     <value>dc=example,dc=com</value>
@@ -257,8 +280,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.bind.dn</name>
     <display-name>Bind User</display-name>
@@ -267,8 +291,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.bind.password</name>
     <display-name>\u200bBind User Password</display-name>
@@ -279,8 +304,9 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.referral</name>
     <value>ignore</value>
@@ -288,18 +314,20 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.ad.domain</name>
     <display-name>Domain Name (Only for AD)</display-name>
-    <value></value>
+    <value/>
     <description>AD domain, only used if Authentication method is AD</description>
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.ad.url</name>
     <value>{{ranger_ug_ldap_url}}</value>
@@ -307,8 +335,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.ad.base.dn</name>
     <value>dc=example,dc=com</value>
@@ -316,8 +345,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.ad.bind.dn</name>
     <value>{{ranger_ug_ldap_bind_dn}}</value>
@@ -325,8 +355,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.ad.bind.password</name>
     <value>{{ranger_usersync_ldap_ldapbindpassword}}</value>
@@ -336,8 +367,9 @@
       <type>password</type>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.ad.user.searchfilter</name>
     <value>{{ranger_ug_ldap_user_searchfilter}}</value>
@@ -345,8 +377,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.ldap.ad.referral</name>
     <value>ignore</value>
@@ -354,26 +387,30 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.audit.jdbc.driver</name>
     <value>{{ranger_jdbc_driver}}</value>
     <description>JDBC driver class name - for audit DB</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.audit.jdbc.url</name>
     <value>{{audit_jdbc_url}}</value>
     <description>JDBC connect string - auto populated based on other values</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.audit.jdbc.user</name>
     <value>{{ranger_audit_db_user}}</value>
     <description>JDBC user - audit</description>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.jpa.audit.jdbc.password</name>
     <value>_</value>
@@ -382,14 +419,16 @@
     <value-attributes>
       <type>password</type>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.audit.jdbc.credential.alias</name>
     <value>rangeraudit</value>
     <description>Alias name for storing JDBC password - for audit user</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.unixauth.remote.login.enabled</name>
     <value>true</value>
@@ -411,8 +450,9 @@
       </entries>
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.unixauth.service.hostname</name>
     <value>{{ugsync_host}}</value>
@@ -420,8 +460,9 @@
     <value-attributes>
       <overridable>false</overridable>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.unixauth.service.port</name>
     <value>5151</value>
@@ -430,20 +471,23 @@
       <type>int</type>
       <overridable>false</overridable>
     </value-attributes>
-  </property>    
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.jpa.jdbc.dialect</name>
     <value>{{jdbc_dialect}}</value>
     <description>JDBC dialect used for policy DB</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.jpa.audit.jdbc.dialect</name>
     <value>{{jdbc_dialect}}</value>
     <description>JDBC dialect used for audit DB</description>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.audit.solr.zookeepers</name>
     <value>NONE</value>
@@ -458,14 +502,16 @@
         <name>is_solrCloud_enabled</name>
       </property>
     </depends-on>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.audit.solr.username</name>
     <value>ranger_solr</value>
     <description>Solr username</description>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.audit.solr.password</name>
     <value>NONE</value>
@@ -474,29 +520,32 @@
     <value-attributes>
       <type>password</type>
     </value-attributes>
-  </property> 
-
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
+  </property>
   <property>
     <name>ranger.sso.providerurl</name>
-    <value></value>
+    <value/>
     <display-name>SSO provider url</display-name>
     <description>Example: https://KNOX_HOST:KNOX_PORT/gateway/TOPOLOGY_NAME/knoxsso/api/v1/websso</description>
     <value-attributes>
       <empty-value-valid>true</empty-value-valid>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.sso.publicKey</name>
-    <value></value>
+    <value/>
     <display-name>SSO public key</display-name>
     <description>Public key for SSO cookie verification</description>
     <value-attributes>
       <type>multiLine</type>
       <empty-value-valid>true</empty-value-valid>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.sso.cookiename</name>
     <value>hadoop-jwt</value>
@@ -505,15 +554,17 @@
     <value-attributes>
       <empty-value-valid>true</empty-value-valid>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.sso.enabled</name>
     <value>false</value>
     <display-name>Enable Ranger SSO</display-name>
-    <description></description>
+    <description/>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.sso.query.param.originalurl</name>
     <value>originalUrl</value>
@@ -522,8 +573,9 @@
     <value-attributes>
       <empty-value-valid>true</empty-value-valid>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
   <property>
     <name>ranger.sso.browser.useragent</name>
     <value>Mozilla,chrome</value>
@@ -532,6 +584,7 @@
     <value-attributes>
       <empty-value-valid>true</empty-value-valid>
     </value-attributes>
+    <on-ambari-upgrade add="true" change="false" delete="false"/>
+    <on-stack-upgrade add="true" change="false" delete="false"/>
   </property>
-
 </configuration>