AMBARI-18726 - Upgrade Orchestration Groups And Stages Should Be Conditionally Controlled (jonathanhurley)

ambari-server/src/main/java/org/apache/ambari/server/state/SecurityType.java

@@ -18,16 +18,23 @@
 
 package org.apache.ambari.server.state;
 
+import javax.xml.bind.annotation.XmlEnum;
+import javax.xml.bind.annotation.XmlEnumValue;
+
 /**
  * SecurityType enumerates the different security types Ambari supports.
  */
+@XmlEnum
 public enum SecurityType {
   /**
    * No security.
    */
+  @XmlEnumValue("none")
   NONE,
+
   /**
    * Kerberos security.
    */
+  @XmlEnumValue("kerberos")
   KERBEROS
 }

ambari-server/src/main/java/org/apache/ambari/server/state/UpgradeContext.java

@@ -116,8 +116,7 @@ public class UpgradeContext {
    *          the type of upgrade, either rolling or non_rolling
    */
   public UpgradeContext(MasterHostResolver resolver, StackId sourceStackId,
-      StackId targetStackId, String version,
-      Direction direction, UpgradeType type) {
+      StackId targetStackId, String version, Direction direction, UpgradeType type) {
     m_version = version;
     m_originalStackId = sourceStackId;
 

ambari-server/src/main/java/org/apache/ambari/server/state/UpgradeHelper.java

@@ -184,7 +184,6 @@ public class UpgradeHelper {
   @Inject
   private Provider<RepositoryVersionDAO> s_repoVersionDAO;
 
-
   /**
    * Get right Upgrade Pack, depends on stack, direction and upgrade type information
    * @param clusterName The name of the cluster
@@ -275,6 +274,13 @@ public class UpgradeHelper {
         continue;
       }
 
+      // if there is a condition on the group, evaluate it and skip scheduling
+      // of this group if the condition has not been satisfied
+      if (null != group.condition && !group.condition.isSatisfied(context)) {
+        LOG.info("Skipping {} while building upgrade orchestration due to {}", group, group.condition );
+        continue;
+      }
+
       UpgradeGroupHolder groupHolder = new UpgradeGroupHolder();
       groupHolder.name = group.name;
       groupHolder.title = group.title;

ambari-server/src/main/java/org/apache/ambari/server/state/stack/upgrade/ClusterGrouping.java

@@ -43,7 +43,10 @@ import org.apache.ambari.server.state.MaintenanceState;
 import org.apache.ambari.server.state.UpgradeContext;
 import org.apache.ambari.server.state.stack.UpgradePack.ProcessingComponent;
 import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
+import com.google.common.base.Objects;
 import com.google.gson.JsonArray;
 import com.google.gson.JsonObject;
 import com.google.gson.JsonPrimitive;
@@ -55,6 +58,10 @@ import com.google.gson.JsonPrimitive;
 @XmlAccessorType(XmlAccessType.FIELD)
 @XmlType(name="cluster")
 public class ClusterGrouping extends Grouping {
+  /**
+   * Logger.
+   */
+  private static final Logger LOG = LoggerFactory.getLogger(ClusterGrouping.class);
 
   /**
    * Stages against a Service and Component, or the Server, that doesn't need a Processing Component.
@@ -104,6 +111,21 @@ public class ClusterGrouping extends Grouping {
     @XmlElement(name="scope")
     public UpgradeScope scope = UpgradeScope.ANY;
 
+    /**
+     * A condition element with can prevent this stage from being scheduled in
+     * the upgrade.
+     */
+    @XmlElement(name = "condition")
+    public Condition condition;
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public String toString() {
+      return Objects.toStringHelper(this).add("id", id).add("title",
+          title).omitNullValues().toString();
+    }
   }
 
   public class ClusterBuilder extends StageWrapperBuilder {
@@ -144,6 +166,15 @@ public class ClusterGrouping extends Grouping {
             continue;
           }
 
+          // if there is a condition on the group, evaluate it and skip scheduling
+          // of this group if the condition has not been satisfied
+          if (null != execution.condition && !execution.condition.isSatisfied(upgradeContext)) {
+            LOG.info("Skipping {} while building upgrade orchestration due to {}", execution,
+                execution.condition);
+
+            continue;
+          }
+
           Task task = execution.task;
 
           StageWrapper wrapper = null;
@@ -187,9 +218,7 @@ public class ClusterGrouping extends Grouping {
 
     Set<String> realHosts = Collections.emptySet();
 
-    if (null != service && !service.isEmpty() &&
-        null != component && !component.isEmpty()) {
-
+    if (StringUtils.isNotEmpty(service) && StringUtils.isNotEmpty(component)) {
       HostsType hosts = ctx.getResolver().getMasterAndHosts(service, component);
 
       if (null == hosts || hosts.hosts.isEmpty()) {
@@ -317,6 +346,7 @@ public class ClusterGrouping extends Grouping {
    * Attempts to merge the given cluster groupings.  This merges the execute stages
    * in an order specific manner.
    */
+  @Override
   public void merge(Iterator<Grouping> iterator) throws AmbariException {
     if (executionStages == null) {
       executionStages = new ArrayList<ExecuteStage>();

ambari-server/src/main/java/org/apache/ambari/server/state/stack/upgrade/Condition.java

@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.ambari.server.state.stack.upgrade;
+
+import javax.xml.bind.annotation.XmlRootElement;
+import javax.xml.bind.annotation.XmlSeeAlso;
+
+import org.apache.ambari.server.state.UpgradeContext;
+import org.apache.ambari.server.state.stack.UpgradePack;
+import org.apache.ambari.server.state.stack.upgrade.ClusterGrouping.ExecuteStage;
+
+/**
+ * The {@link Condition} interface represents a condition in an
+ * {@link UpgradePack} which must be satisified in order for a {@link Grouping}
+ * or {@link ExecuteStage} to be scheduled.
+ */
+@XmlRootElement
+@XmlSeeAlso(value = { SecurityCondition.class, ConfigurationCondition.class })
+public class Condition {
+
+  /**
+   * Asks the condition whether it is currently satisfied.
+   *
+   * @param upgradeContext
+   *          the upgrade context.
+   * @return {@code true} if the condition is satisfied, {@code false}
+   *         otherwise.
+   */
+  public boolean isSatisfied(UpgradeContext upgradeContext) {
+    return false;
+  }
+}

ambari-server/src/main/java/org/apache/ambari/server/state/stack/upgrade/ConfigurationCondition.java

@@ -0,0 +1,116 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.ambari.server.state.stack.upgrade;
+
+import java.util.Map;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlEnum;
+import javax.xml.bind.annotation.XmlEnumValue;
+import javax.xml.bind.annotation.XmlType;
+
+import org.apache.ambari.server.state.Cluster;
+import org.apache.ambari.server.state.Config;
+import org.apache.ambari.server.state.UpgradeContext;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang.StringUtils;
+
+import com.google.common.base.Objects;
+
+/**
+ * The {@link ConfigurationCondition} class is used to represent a condition on
+ * a property.
+ */
+@XmlType(name = "config")
+@XmlAccessorType(XmlAccessType.FIELD)
+public final class ConfigurationCondition extends Condition {
+
+  /**
+   * The type of comparison to make.
+   */
+  @XmlEnum
+  public enum ComparisonType {
+
+    /**
+     * Equals comparison.
+     */
+    @XmlEnumValue("equals")
+    EQUALS;
+  }
+
+  /**
+   * The configuration type, such as {@code hdfs-site}.
+   */
+  @XmlAttribute(name = "type")
+  public String type;
+
+  /**
+   * The configuration property key.
+   */
+  @XmlAttribute(name = "property")
+  public String property;
+
+  /**
+   * The value to compare against.
+   */
+  @XmlAttribute(name = "value")
+  public String value;
+
+  /**
+   * The type of comparison to make.
+   */
+  @XmlAttribute(name = "comparison")
+  public ComparisonType comparisonType;
+
+  /**
+   * {@inheritDoc}
+   */
+  @Override
+  public String toString() {
+    return Objects.toStringHelper(this).add("type", type).add("property", property).add(value,
+        value).add("comparison", comparisonType).omitNullValues().toString();
+  }
+
+  /**
+   * {@inheritDoc}
+   */
+  @Override
+  public boolean isSatisfied(UpgradeContext upgradeContext) {
+    Cluster cluster = upgradeContext.getCluster();
+    Config config = cluster.getDesiredConfigByType(type);
+    if (null == config) {
+      return false;
+    }
+
+    Map<String, String> properties = config.getProperties();
+    if (MapUtils.isEmpty(properties)) {
+      return false;
+    }
+
+    String propertyValue = properties.get(property);
+    switch (comparisonType) {
+      case EQUALS:
+        return StringUtils.equals(propertyValue, value);
+      default:
+        return false;
+    }
+  }
+}
+

ambari-server/src/main/java/org/apache/ambari/server/state/stack/upgrade/Grouping.java

@@ -39,6 +39,8 @@ import org.apache.ambari.server.state.stack.UpgradePack.ProcessingComponent;
 import org.apache.ambari.server.utils.SetUtils;
 import org.apache.commons.lang.StringUtils;
 
+import com.google.common.base.Objects;
+
 /**
  *
  */
@@ -81,6 +83,13 @@ public class Grouping {
   @XmlElement(name="scope")
   public UpgradeScope scope = UpgradeScope.ANY;
 
+  /**
+   * A condition element with can prevent this entire group from being scheduled
+   * in the upgrade.
+   */
+  @XmlElement(name = "condition")
+  public Condition condition;
+
   /**
    * Gets the default builder.
    */
@@ -379,4 +388,12 @@ public class Grouping {
       }
     }
   }
+
+  /**
+   * {@inheritDoc}
+   */
+  @Override
+  public String toString() {
+    return Objects.toStringHelper(this).add("name", name).toString();
+  }
 }

ambari-server/src/main/java/org/apache/ambari/server/state/stack/upgrade/SecurityCondition.java

@@ -0,0 +1,64 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.ambari.server.state.stack.upgrade;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlType;
+
+import org.apache.ambari.server.state.Cluster;
+import org.apache.ambari.server.state.SecurityType;
+import org.apache.ambari.server.state.UpgradeContext;
+
+import com.google.common.base.Objects;
+
+/**
+ * The {@link SecurityCondition} class is used to represent that the cluster has
+ * been configured for a specific type of security model.
+ *
+ * @see SecurityType
+ */
+@XmlType(name = "security")
+@XmlAccessorType(XmlAccessType.FIELD)
+public final class SecurityCondition extends Condition {
+
+  /**
+   * The type of security which much be enabled.
+   */
+  @XmlAttribute(name = "type")
+  public SecurityType securityType;
+
+  /**
+   * {@inheritDoc}
+   */
+  @Override
+  public String toString() {
+    return Objects.toStringHelper(this).add("type", securityType).omitNullValues().toString();
+  }
+
+  /**
+   * {@inheritDoc}
+   */
+  @Override
+  public boolean isSatisfied(UpgradeContext upgradeContext) {
+    Cluster cluster = upgradeContext.getCluster();
+    return cluster.getSecurityType() == securityType;
+  }
+}
+

ambari-server/src/main/resources/stacks/HDP/2.1/upgrades/nonrolling-upgrade-2.3.xml

@@ -208,7 +208,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -656,7 +656,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.2/upgrades/nonrolling-upgrade-2.2.xml

@@ -211,7 +211,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -586,7 +586,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.2/upgrades/nonrolling-upgrade-2.3.xml

@@ -243,7 +243,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -888,7 +888,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.2/upgrades/nonrolling-upgrade-2.4.xml

@@ -256,7 +256,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -927,7 +927,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.2/upgrades/upgrade-2.2.xml

@@ -368,7 +368,7 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction"/>
       </execute-stage>
     </group>

ambari-server/src/main/resources/stacks/HDP/2.2/upgrades/upgrade-2.3.xml

@@ -414,7 +414,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction"/>
       </execute-stage>
 

ambari-server/src/main/resources/stacks/HDP/2.2/upgrades/upgrade-2.4.xml

@@ -419,7 +419,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction"/>
       </execute-stage>
 

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/nonrolling-upgrade-2.3.xml

@@ -240,7 +240,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -661,7 +661,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/nonrolling-upgrade-2.4.xml

@@ -241,7 +241,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -712,7 +712,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/nonrolling-upgrade-2.5.xml

@@ -252,7 +252,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -418,6 +418,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Calculating Ranger Properties">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.RangerKerberosConfigCalculation">
           <summary>Calculating Ranger Properties</summary>
         </task>
@@ -474,7 +475,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -849,7 +851,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/nonrolling-upgrade-2.6.xml

@@ -253,7 +253,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -419,6 +419,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Calculating Ranger Properties">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.RangerKerberosConfigCalculation">
           <summary>Calculating Ranger Properties</summary>
         </task>
@@ -470,7 +471,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -845,7 +847,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/upgrade-2.3.xml

@@ -416,7 +416,7 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/upgrade-2.4.xml

@@ -460,7 +460,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction" />
       </execute-stage>
 

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/upgrade-2.5.xml

@@ -201,7 +201,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -509,6 +510,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Ranger Kerberos Keytab Check">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.KerberosKeytabsAction">
           <summary>Ranger Kerberos Keytab Check</summary>
           <message>Please follow below steps to complete upgrade in kerberos environment</message>
@@ -532,7 +534,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction" />
       </execute-stage>
 

ambari-server/src/main/resources/stacks/HDP/2.3/upgrades/upgrade-2.6.xml

@@ -202,7 +202,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -510,6 +511,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Ranger Kerberos Keytab Check">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.KerberosKeytabsAction">
           <summary>Ranger Kerberos Keytab Check</summary>
           <message>Please follow below steps to complete upgrade in kerberos environment</message>
@@ -533,7 +535,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction" />
       </execute-stage>
 

ambari-server/src/main/resources/stacks/HDP/2.4/upgrades/nonrolling-upgrade-2.4.xml

@@ -240,7 +240,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -654,7 +654,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.4/upgrades/nonrolling-upgrade-2.5.xml

@@ -249,7 +249,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -325,6 +325,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Calculating Ranger Properties">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.RangerKerberosConfigCalculation">
           <summary>Calculating Ranger Properties</summary>
         </task>
@@ -437,7 +438,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -813,7 +815,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.4/upgrades/nonrolling-upgrade-2.6.xml

@@ -250,7 +250,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -326,6 +326,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Calculating Ranger Properties">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.RangerKerberosConfigCalculation">
           <summary>Calculating Ranger Properties</summary>
         </task>
@@ -424,7 +425,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -800,7 +802,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.4/upgrades/upgrade-2.4.xml

@@ -413,7 +413,7 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.4/upgrades/upgrade-2.5.xml

@@ -186,7 +186,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -494,6 +495,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Ranger Kerberos Keytab Check">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.KerberosKeytabsAction">
           <summary>Ranger Kerberos Keytab Check</summary>
           <message>Please follow below steps to complete upgrade in kerberos environment</message>
@@ -517,7 +519,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction" />
       </execute-stage>
 

ambari-server/src/main/resources/stacks/HDP/2.4/upgrades/upgrade-2.6.xml

@@ -191,7 +191,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -499,6 +500,7 @@
       </execute-stage>
 
       <execute-stage service="RANGER" component="RANGER_ADMIN" title="Ranger Kerberos Keytab Check">
+        <condition xsi:type="security" type="kerberos"/>
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.KerberosKeytabsAction">
           <summary>Ranger Kerberos Keytab Check</summary>
           <message>Please follow below steps to complete upgrade in kerberos environment</message>
@@ -522,7 +524,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction" />
       </execute-stage>
 

ambari-server/src/main/resources/stacks/HDP/2.5/upgrades/nonrolling-upgrade-2.5.xml

@@ -263,7 +263,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -309,7 +309,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -719,7 +720,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.5/upgrades/nonrolling-upgrade-2.6.xml

@@ -263,7 +263,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -304,7 +304,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -714,7 +715,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.5/upgrades/upgrade-2.5.xml

@@ -152,7 +152,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -460,7 +461,7 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.5/upgrades/upgrade-2.6.xml

@@ -145,7 +145,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -453,7 +454,7 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.6/upgrades/nonrolling-upgrade-2.6.xml

@@ -263,7 +263,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -282,7 +282,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -692,7 +693,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/stacks/HDP/2.6/upgrades/upgrade-2.6.xml

@@ -145,7 +145,8 @@
     the new stack-level Kerberos descriptor.
     -->
     <group xsi:type="cluster" name="UPDATE_KERBEROS_DESCRIPTORS" title="Update Kerberos Descriptors">
-      <execute-stage title="Update the user-specified Kerberos descriptor" service="" component="">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Update the user-specified Kerberos descriptor">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpgradeUserKerberosDescriptor"/>
       </execute-stage>
     </group>
@@ -453,7 +454,7 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/main/resources/upgrade-pack.xsd

@@ -55,6 +55,40 @@
     </xs:restriction>
   </xs:simpleType>
   
+  <xs:simpleType name="security-type">
+    <xs:restriction base="xs:string">
+      <xs:enumeration value="none" />
+      <xs:enumeration value="kerberos" />
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name="config-condition-comparison-type">
+    <xs:restriction base="xs:string">
+      <xs:enumeration value="equals" />
+    </xs:restriction>
+  </xs:simpleType>
+  
+  <xs:complexType name="abstract-condition-type" abstract="true"/>
+    
+  <xs:complexType name="config">
+    <xs:complexContent>
+      <xs:extension base="abstract-condition-type">  
+        <xs:attribute name="type" type="xs:Name" use="required"/>
+        <xs:attribute name="property" type="xs:Name" use="required"/>
+        <xs:attribute name="value" type="xs:string" use="required"/>
+        <xs:attribute name="comparison" type="config-condition-comparison-type" use="required"/>
+      </xs:extension>
+    </xs:complexContent>
+  </xs:complexType>
+  
+  <xs:complexType name="security">
+    <xs:complexContent>
+      <xs:extension base="abstract-condition-type">  
+        <xs:attribute name="type" type="security-type" use="required"/>
+      </xs:extension>
+    </xs:complexContent>
+  </xs:complexType>
+  
   <xs:complexType name="prerequisite-check-type">
     <xs:sequence>
       <xs:element name="check" minOccurs="0" maxOccurs="unbounded" />
@@ -81,6 +115,7 @@
   
   <xs:complexType name="abstract-group-type" abstract="true">
     <xs:sequence>
+      <xs:element name="condition" type="abstract-condition-type" minOccurs="0" maxOccurs="1"/>
       <xs:element name="scope" type="scope-type" minOccurs="0" />
       <xs:element name="direction" type="direction-type" minOccurs="0" />
       <xs:element name="service-check" minOccurs="0" type="xs:boolean" />
@@ -101,9 +136,9 @@
       <xs:element name="service" minOccurs="0" maxOccurs="unbounded">
         <xs:complexType>
           <xs:sequence>
-            <xs:element name="component" minOccurs="1" maxOccurs="unbounded" />
+            <xs:element name="component" minOccurs="1" maxOccurs="unbounded" type="xs:NMTOKEN"/>
           </xs:sequence>
-          <xs:attribute name="name" />
+          <xs:attribute name="name" type="xs:NMTOKEN" />
         </xs:complexType>
       </xs:element>
     </xs:sequence>
@@ -116,6 +151,17 @@
       <xs:extension base="abstract-group-type">
         <xs:sequence>
           <xs:element name="execute-stage" minOccurs="1" maxOccurs="unbounded">
+            <xs:complexType>              
+              <xs:sequence minOccurs="0" maxOccurs="unbounded">
+                <xs:element name="condition" type="abstract-condition-type" minOccurs="0" maxOccurs="1"/>
+                <xs:element name="direction" type="direction-type" minOccurs="0" maxOccurs="1"/>
+                <xs:element name="scope" type="scope-type" minOccurs="0" maxOccurs="1"/>                
+                <xs:element name="task" type="abstract-task-type" minOccurs="1" maxOccurs="1"/>
+              </xs:sequence>              
+              <xs:attribute name="title" type="xs:string" />
+              <xs:attribute name="service" type="xs:NMTOKEN" />
+              <xs:attribute name="component" type="xs:NMTOKEN" />
+            </xs:complexType>
           </xs:element>
         </xs:sequence>
       </xs:extension>
@@ -298,11 +344,11 @@
                 Want to use <xs:assert> to make sure that a pre-downgrade is available i
                 pre-upgrade is set.  It appears as though that is not yet available to jaxb.
                  -->
-                <xs:attribute name="name" />
+                <xs:attribute name="name" type="xs:NMTOKEN" />
               </xs:complexType>
             </xs:element>
           </xs:sequence>
-          <xs:attribute name="name" />
+          <xs:attribute name="name" type="xs:NMTOKEN"/>
         </xs:complexType>
       </xs:element>
     </xs:sequence>

ambari-server/src/test/java/org/apache/ambari/server/state/UpgradeHelperTest.java

@@ -59,6 +59,7 @@ import org.apache.ambari.server.state.stack.upgrade.Direction;
 import org.apache.ambari.server.state.stack.upgrade.ExecuteTask;
 import org.apache.ambari.server.state.stack.upgrade.Grouping;
 import org.apache.ambari.server.state.stack.upgrade.ManualTask;
+import org.apache.ambari.server.state.stack.upgrade.SecurityCondition;
 import org.apache.ambari.server.state.stack.upgrade.StageWrapper;
 import org.apache.ambari.server.state.stack.upgrade.StopGrouping;
 import org.apache.ambari.server.state.stack.upgrade.Task;
@@ -73,6 +74,7 @@ import org.junit.Test;
 import org.springframework.security.core.context.SecurityContextHolder;
 
 import com.google.common.collect.Lists;
+import com.google.common.collect.Sets;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
 import com.google.inject.Binder;
@@ -87,8 +89,8 @@ import com.google.inject.util.Modules;
  */
 public class UpgradeHelperTest {
 
-  private static final StackId HDP_21 = new StackId("HPD-2.1.1");
-  private static final StackId HDP_22 = new StackId("HPD-2.2.0");
+  private static final StackId HDP_21 = new StackId("HDP-2.1.1");
+  private static final StackId HDP_22 = new StackId("HDP-2.2.0");
   private static final String UPGRADE_VERSION = "2.2.1.0-1234";
   private static final String DOWNGRADE_VERSION = "2.2.0.0-1234";
 
@@ -650,7 +652,7 @@ public class UpgradeHelperTest {
     Cluster cluster = makeCluster();
 
     UpgradeContext context = new UpgradeContext(m_masterHostResolver, HDP_21,
-                                                HDP_21, UPGRADE_VERSION, Direction.UPGRADE, UpgradeType.ROLLING);
+        HDP_21, UPGRADE_VERSION, Direction.UPGRADE, UpgradeType.ROLLING);
 
     List<UpgradeGroupHolder> groups = m_upgradeHelper.createSequence(upgrade, context);
 
@@ -1807,7 +1809,9 @@ public class UpgradeHelperTest {
     };
 
     MasterHostResolver resolver = new MasterHostResolver(m_configHelper, c);
-    UpgradeContext context = new UpgradeContext(resolver, stackId, stackId2, "2.2.0", Direction.UPGRADE, UpgradeType.NON_ROLLING);
+    UpgradeContext context = new UpgradeContext(resolver, stackId, stackId2, "2.2.0",
+        Direction.UPGRADE, UpgradeType.NON_ROLLING);
+
     List<UpgradeGroupHolder> groups = m_upgradeHelper.createSequence(upgradePack, context);
 
     assertEquals(1, groups.size());
@@ -1815,12 +1819,63 @@ public class UpgradeHelperTest {
     sch1.setVersion("2.1.1");
     sch2.setVersion("2.1.1");
     resolver = new MasterHostResolver(m_configHelper, c, "2.1.1");
-    context = new UpgradeContext(resolver, stackId2, stackId, "2.1.1", Direction.DOWNGRADE, UpgradeType.NON_ROLLING);
+    context = new UpgradeContext(resolver, stackId2, stackId, "2.1.1", Direction.DOWNGRADE,
+        UpgradeType.NON_ROLLING);
+
     groups = m_upgradeHelper.createSequence(upgradePack, context);
 
     assertTrue(groups.isEmpty());
   }
 
+  /**
+   * Tests that the {@link SecurityCondition} element correctly restricts the groups in
+   * an upgrade.
+   *
+   * @throws Exception
+   */
+  @Test
+  public void testUpgradeConditions() throws Exception {
+    Map<String, UpgradePack> upgrades = ambariMetaInfo.getUpgradePacks("HDP", "2.2.0");
+    assertTrue(upgrades.containsKey("upgrade_test_conditions"));
+    UpgradePack upgrade = upgrades.get("upgrade_test_conditions");
+    assertNotNull(upgrade);
+
+    Cluster cluster = makeCluster();
+
+    UpgradeContext context = new UpgradeContext(m_masterHostResolver, HDP_22,
+        HDP_22, UPGRADE_VERSION, Direction.UPGRADE, UpgradeType.ROLLING);
+
+    // initially, no conditions should be met
+    List<UpgradeGroupHolder> groups = m_upgradeHelper.createSequence(upgrade, context);
+    assertEquals(0, groups.size());
+
+    // set the configuration property and try again
+    Map<String, String> fooConfigs = new HashMap<String, String>();
+    fooConfigs.put("foo-property", "foo-value");
+    ConfigurationRequest configurationRequest = new ConfigurationRequest();
+    configurationRequest.setClusterName(cluster.getClusterName());
+    configurationRequest.setType("foo-site");
+    configurationRequest.setVersionTag("version1");
+    configurationRequest.setProperties(fooConfigs);
+
+    final ClusterRequest clusterRequest = new ClusterRequest(cluster.getClusterId(),
+        cluster.getClusterName(), cluster.getDesiredStackVersion().getStackVersion(), null);
+
+    clusterRequest.setDesiredConfig(Collections.singletonList(configurationRequest));
+    m_managementController.updateClusters(Sets.newHashSet(clusterRequest), null);
+
+    // the config condition should now be set
+    groups = m_upgradeHelper.createSequence(upgrade, context);
+    assertEquals(1, groups.size());
+    assertEquals("ZOOKEEPER_CONFIG_CONDITION_TEST", groups.get(0).name);
+
+    // now change the cluster security so the other conditions come back too
+    cluster.setSecurityType(SecurityType.KERBEROS);
+
+    groups = m_upgradeHelper.createSequence(upgrade, context);
+    assertEquals(3, groups.size());
+  }
+
   /**
    * Extend {@link org.apache.ambari.server.stack.MasterHostResolver} in order
    * to overwrite the JMX methods.

ambari-server/src/test/java/org/apache/ambari/server/state/stack/upgrade/StageWrapperBuilderTest.java

@@ -44,7 +44,9 @@ public class StageWrapperBuilderTest {
    */
   @Test
   public void testBuildOrder() throws Exception {
-    UpgradeContext upgradeContext = new UpgradeContext(null, null, null, null, Direction.UPGRADE, UpgradeType.ROLLING);
+    UpgradeContext upgradeContext = new UpgradeContext(null, null, null, null, Direction.UPGRADE,
+        UpgradeType.ROLLING);
+
     MockStageWrapperBuilder builder = new MockStageWrapperBuilder(null);
     List<StageWrapper> stageWrappers = builder.build(upgradeContext);
     List<Integer> invocationOrder = builder.getInvocationOrder();
@@ -65,7 +67,9 @@ public class StageWrapperBuilderTest {
    */
   @Test
   public void testAutoSkipCheckInserted() throws Exception {
-    UpgradeContext upgradeContext = new UpgradeContext(null, null, null, null, Direction.UPGRADE, UpgradeType.ROLLING);
+    UpgradeContext upgradeContext = new UpgradeContext(null, null, null, null, Direction.UPGRADE,
+        UpgradeType.ROLLING);
+
     upgradeContext.setAutoSkipComponentFailures(true);
     upgradeContext.setAutoSkipServiceCheckFailures(true);
 

ambari-server/src/test/resources/stacks/HDP/2.1.1/upgrades/upgrade_direction.xml

@@ -49,7 +49,7 @@
     </group>
     
     <group xsi:type="cluster" name="PRE_POST_CLUSTER" title="Run on All">
-      <execute-stage title="Host Finalize" service="HDFS" component="NAMENODE" >
+      <execute-stage title="Host Finalize" service="HDFS" component="NAMENODE">
         <task xsi:type="execute" hosts="master">
           <script>scripts/ru_run_all.py</script>
           <function>actionexecute</function>
@@ -65,14 +65,14 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="NameNode Finalize" service="HDFS" component="NAMENODE" >
+      <execute-stage title="NameNode Finalize" service="HDFS" component="NAMENODE">
         <task xsi:type="execute" hosts="master">
           <script>scripts/namenode.py</script>
           <function>actionexecute</function>
         </task>
       </execute-stage>      
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.1.1/upgrades/upgrade_nonrolling_new_stack.xml

@@ -238,7 +238,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Target Stack">
-      <execute-stage title="Update Target Stack" service="" component="">
+      <execute-stage title="Update Target Stack">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -606,7 +606,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.1.1/upgrades/upgrade_test.xml

@@ -126,7 +126,7 @@
           <function>list</function>
         </task>
       </execute-stage>
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.1.1/upgrades/upgrade_test_checks.xml

@@ -126,7 +126,7 @@
           <function>list</function>
         </task>
       </execute-stage>
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.1.1/upgrades/upgrade_test_nonrolling.xml

@@ -108,7 +108,7 @@
 
     <!-- After processing this group, will change the effective Stack of the UpgradeContext object. -->
     <group xsi:type="update-stack" name="UPDATE_DESIRED_STACK_ID" title="Update Desired Stack Id">
-      <execute-stage title="Update Desired Stack Id" service="" component="">
+      <execute-stage title="Update Desired Stack Id">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.UpdateDesiredStackAction">
         </task>
       </execute-stage>
@@ -182,7 +182,7 @@
         </task>
       </execute-stage>
 
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.1.1/upgrades/upgrade_test_partial.xml

@@ -136,7 +136,7 @@
           <function>list</function>
         </task>
       </execute-stage>
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.1.1/upgrades/upgrade_to_new_stack.xml

@@ -117,7 +117,7 @@
         </task>
       </execute-stage>
       
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.2.0/upgrades/upgrade_test.xml

@@ -115,7 +115,7 @@
           <function>actionexecute</function>
         </task>
       </execute-stage>
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.2.0/upgrades/upgrade_test_15388.xml

@@ -126,7 +126,7 @@
           <function>actionexecute</function>
         </task>
       </execute-stage>
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.2.0/upgrades/upgrade_test_checks.xml

@@ -132,7 +132,7 @@
           <function>list</function>
         </task>
       </execute-stage>
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>

ambari-server/src/test/resources/stacks/HDP/2.2.0/upgrades/upgrade_test_conditions.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0"?>
+<!--
+   Licensed to the Apache Software Foundation (ASF) under one or more
+   contributor license agreements.  See the NOTICE file distributed with
+   this work for additional information regarding copyright ownership.
+   The ASF licenses this file to You under the Apache License, Version 2.0
+   (the "License"); you may not use this file except in compliance with
+   the License.  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+-->
+<upgrade xsi:noNamespaceSchemaLocation="upgrade-pack.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <target>2.5.*.*</target>
+  <target-stack>HDP-2.5.0</target-stack>
+  <type>ROLLING</type>
+
+  <order>
+    <group xsi:type="cluster" name="CLUSTER_SECURITY_CONDITION_TEST" title="Cluster Security Condition Test">
+      <condition xsi:type="security" type="kerberos"/>
+      <execute-stage title="Confirm 1">
+        <task xsi:type="manual">
+          <message>Foo</message>
+        </task>
+      </execute-stage>
+    </group>
+
+    <group name="ZOOKEEPER_CONFIG_CONDITION_TEST" title="ZooKeeper Config Condition Test">
+      <condition xsi:type="config" type="foo-site" property="foo-property" value="foo-value" comparison="equals"/>
+      <skippable>true</skippable>
+      <allow-retry>false</allow-retry>
+      <service name="ZOOKEEPER">
+        <component>ZOOKEEPER_SERVER</component>
+        <component>ZOOKEEPER_CLIENT</component>
+      </service>
+    </group>
+    
+    <group xsi:type="cluster" name="STAGE_SECURITY_CONDITION_TEST" title="Stage Security Condition Test">      
+      <execute-stage title="Confirm 1">
+        <condition xsi:type="security" type="kerberos"/>
+        <task xsi:type="manual">
+          <message>Foo</message>
+        </task>
+      </execute-stage>
+     </group>
+  </order>
+
+  <processing>
+    <service name="ZOOKEEPER">
+      <component name="ZOOKEEPER_SERVER">
+        <upgrade>
+          <task xsi:type="restart-task" />
+        </upgrade>
+      </component>
+    </service>
+  </processing>
+</upgrade>

ambari-server/src/test/resources/stacks_with_upgrade_cycle/HDP/2.2.0/upgrades/upgrade_test_15388.xml

@@ -126,7 +126,7 @@
           <function>actionexecute</function>
         </task>
       </execute-stage>
-      <execute-stage title="Save Cluster State" service="" component="">
+      <execute-stage title="Save Cluster State">
         <task xsi:type="server_action" class="org.apache.ambari.server.serveraction.upgrades.FinalizeUpgradeAction">
         </task>
       </execute-stage>
@@ -222,7 +222,7 @@
             <message>The HiveServer port will now change to 10010 if hive is using a binary transfer mode or 10011 if hive is using an http transport mode. You can use "netstat -anp | grep 1001[01]" to determine if the port is available on each of following HiveServer host(s): {{hosts.all}}. If the port is not available, the process using it must be terminated.</message>
           </task>
 
-          <task xsi:type="configure" id="foo" >
+          <task xsi:type="configure" id="foo">
           </task>
         </pre-upgrade>
         <upgrade />