I tested the upgrade tool on a 3 node secure hadoop cluster and was able to run upgrade tool after kinit.
The upgrade went smoothly and all the dataset and meta tables got upgraded.
I was not able to start cdap master due to this bug: https://issues.cask.co/browse/CDAP-1882
and hence was not able to query services and other functional stuff.
we just have to be sure to document that users have to kinit before running the upgrade tool before closing this jira out.