Opentsdb/Kerberos with HDP 3.1

[VeljkoC]

Hi,

I have read how to configure opentsdb with kerberos #1010

Create a service keytab
Create a JAAS file, it should look like this

Client {
com.sun.security.auth.module.Krb5LoginModule required
principal="opentsdb/OPENTSDB_HOST@KRB5_REALM"
useTicketCache=true
useKeyTab=false;
};

You must set useTicketCache, Opentsdb is not able to get a ticket for you
3. Create a crontab to renew your krb5 ticket, it should look like this :

0 */9 * * * /usr/bin/kinit opentsdb/OPENTSDB_HOST@KRB5_REALM -kt /your/keytab/path

You must edit the opentsdb init script

4.1 replace user by a dedicated user, useful for crontab
4.2 add the following java option

JVMARGS="${JVMARGS} -Djava.security.auth.login.config=/your/jaas/file/path"

But it is unclear to me these 4 questions:

1. Do we need to setup also Hbase to use Kerberos? As we are familiar Kerberos is enabled on HDFS. I am not sure regarding the Hbase.
2. opentsdb/OPENTSDB_HOST@KRB5_REALM for which user this principle should be created?

3. 4.2 add the following java option
   

JVMARGS="${JVMARGS} -Djava.security.auth.login.config=/your/jaas/file/path"
where we should add this line?
4. useKeyTab=false;
why is this parameter set to false when we are referencing keytab file?