private void ensureCredentials(Cluster cluster, AddServiceInfo validatedRequest) {
    resourceProviders.createCredentials(validatedRequest);
    if (cluster.getSecurityType() == SecurityType.KERBEROS) {
      try {
        controller.getKerberosHelper().validateKDCCredentials(cluster);
      } catch (KerberosMissingAdminCredentialsException | KerberosAdminAuthenticationException | KerberosInvalidConfigurationException e) {
        CHECK.wrapInUnchecked(e, IllegalArgumentException::new, "KDC credentials validation failed: %s", e);
      } catch (AmbariException e) {
        CHECK.wrapInUnchecked(e, IllegalStateException::new, "Error occurred while validating KDC credentials: %s", e);
      }
    }
  }
Stores any credentials provided in the request, and
validates KDC credentials if the cluster has Kerberos enabled.
The goal is to make sure that no resources (services, components, etc.) get created
(except the credentials) if the request as a whole would fail due to missing credentials.
ambari-server/src/main/java/org/apache/ambari/server/topology/addservice/AddServiceOrchestrator.java