We're updating the issue view to help you get more done. 

Ability to update keytab location of namespace


Currently, when a namespace is created, impersonation settings can be configured - a principal and keytab path.
However, these settings are not mutable.
This JIRA is to allow modifying the keytab path after the namespace creation, via the namespace update APIs. The principal will need to remain mutable, because the principal is cached and all of the namespace entities are also owned by the original principal.

Release Notes

Added the ability to update the keytab URI for namespace's impersonation configuration.


Ali Anwar
October 11, 2017, 7:29 PM

We should be able to modify DefaultNamespaceAdmin to allow updating the keytabURI field.
We should continue disallowing modifying the other fields in the namespace config, such as principal, hbaseNamespace, etc.

Vishal Kapoor
October 11, 2017, 8:17 PM

Hi Ali,
Everything else can stay read only, we are only looking to be able to change the keytab file location...

Rohit Sinha
April 3, 2018, 1:16 AM

This needs to be changed according to a standard way of specifying keytab files in CDAP. After the namespace impersonation while doing app impersonation we came with the standard way that a user will specify a keytab directory in cdap-site.xml and an expression to generate keytab file name by substitution of the principal name.
We already have a lot of convoluted code to support the lookup of principal/keytab from namespace store which looks into app.meta. The impersonation principal should be stored in the owner store and keytab should be available in the configured directory. If a user wishes to store it at some other place the can always so it and have a symlink in the keytab dir and keep changing it as and when needed. This eliminates the need for storing keytab location in cdap for namespace and standardize how we find keytab files. With this change, there is no need to make the keytab location inside cdap mutable or even store it in the first place.

Chengfeng Mao
April 5, 2018, 9:02 PM


Chengfeng Mao


Ali Anwar


Docs Impact


UX Impact



Fix versions