protected void updateKerberosConfigurations() throws AmbariException {
    AmbariManagementController ambariManagementController = injector.getInstance(AmbariManagementController.class);
    Clusters clusters = ambariManagementController.getClusters();
    if (clusters != null) {
      Map<String, Cluster> clusterMap = clusters.getClusters();

      if (!MapUtils.isEmpty(clusterMap)) {
        for (Cluster cluster : clusterMap.values()) {
          Config config = cluster.getDesiredConfigByType("kerberos-env");
          if (config != null) {
            Map<String, String> properties = config.getProperties();
            if (properties.containsKey("group")) {
              // Covert kerberos-env/group to kerberos-env/ipa_user_group
              updateConfigurationPropertiesForCluster(cluster, "kerberos-env",
                Collections.singletonMap("ipa_user_group", properties.get("group")), Collections.singleton("group"),
                true, false);
            }
          }
          if (config != null) {
            PrepareKerberosIdentitiesServerAction prepareIdentities = getPrepareIdentityServerAction();
            ExecutionCommand executionCommand = new ExecutionCommand();
            executionCommand.setCommandParams(new HashMap<String, String>() {{
              put(KerberosServerAction.DEFAULT_REALM, config.getProperties().get("realm"));
            }});
            prepareIdentities.setExecutionCommand(executionCommand);

            // inject whatever we need for calling desired server action
            injector.injectMembers(prepareIdentities);
            KerberosHelper kerberosHelper = injector.getInstance(KerberosHelper.class);

            injector.getInstance(AmbariServer.class).performStaticInjection();
            AmbariServer.setController(injector.getInstance(AmbariManagementController.class));

            KerberosDescriptor kerberosDescriptor = kerberosHelper.getKerberosDescriptor(cluster, false);
            Map<String, Map<String, String>> kerberosConfigurations = new HashMap<>();
            Map<String, Set<String>> propertiesToIgnore = new HashMap<>();
            List<ServiceComponentHost> schToProcess = kerberosHelper.getServiceComponentHostsToProcess(cluster, kerberosDescriptor, null, null);
            Map<String, Map<String, String>> configurations = kerberosHelper.calculateConfigurations(cluster, null, kerberosDescriptor, false, false, null);
            boolean includeAmbariIdentity = true;
            String dataDirectory = kerberosHelper.createTemporaryDirectory().getAbsolutePath();
            try {
              executeInTransaction(new Runnable() {
                @Override
                public void run() {
                  try {
                    prepareIdentities.processServiceComponentHosts(cluster, kerberosDescriptor, schToProcess, null, dataDirectory, configurations, kerberosConfigurations, includeAmbariIdentity, propertiesToIgnore);
                  } catch (AmbariException e) {
                    throw new RuntimeException(e);
                  }
                }
              });
            } catch (RuntimeException e) {
              throw new AmbariException("Failed to upgrade kerberos tables", e);
            }
          }
        }
      }
    }


  }
Upgrades kerberos related data.
Also creates keytabs and principals database records. This happens via code in PrepareKerberosIdentitiesServerAction,
so code reused and all changes will be reflected in upgrade.

@throws AmbariException
ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog270.java