AMBARI-18836. Remove group readable from hdfs headless keytab (Shi Wang via rlevas)

ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/kerberos.json

@@ -56,7 +56,7 @@
                 },
                 "group": {
                   "name": "${cluster-env/user_group}",
-                  "access": "r"
+                  "access": ""
                 },
                 "configuration": "hadoop-env/hdfs_user_keytab"
               }

ambari-server/src/main/resources/common-services/HIVE/0.12.0.2.0/package/scripts/webhcat.py

@@ -66,16 +66,6 @@ def webhcat():
             group=params.user_group,
             cd_access="a")
 
-  if params.security_enabled:
-    kinit_if_needed = format("{kinit_path_local} -kt {hdfs_user_keytab} {hdfs_principal_name};")
-  else:
-    kinit_if_needed = ""
-
-  if kinit_if_needed:
-    Execute(kinit_if_needed,
-            user=params.webhcat_user,
-            path='/bin'
-    )
 
   # Replace _HOST with hostname in relevant principal-related properties
   webhcat_site = params.config['configurations']['webhcat-site'].copy()

ambari-server/src/main/resources/stacks/HDP/2.5/services/HDFS/kerberos.json

@@ -66,7 +66,7 @@
                 },
                 "group": {
                   "name": "${cluster-env/user_group}",
-                  "access": "r"
+                  "access": ""
                 },
                 "configuration": "hadoop-env/hdfs_user_keytab"
               }

ambari-server/src/test/python/stacks/2.0.6/HIVE/test_webhcat_server.py

@@ -253,10 +253,6 @@ class TestWebHCatServer(RMFTestCase):
                               create_parents = True,
                               cd_access = 'a'
                               )
-    self.assertResourceCalled('Execute', '/usr/bin/kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs;',
-                              path = ['/bin'],
-                              user = 'hcat',
-                              )
     self.assertResourceCalled('XmlConfig', 'webhcat-site.xml',
                               owner = 'hcat',
                               group = 'hadoop',