public void addDeleteKeytabFilesStage(Cluster cluster, List<ServiceComponentHost> serviceComponentHosts,
                                          String clusterHostInfoJson, String hostParamsJson,
                                          Map<String, String> commandParameters,
                                          RoleCommandOrder roleCommandOrder,
                                          RequestStageContainer requestStageContainer,
                                          Set<String> hostsWithValidKerberosClient)
      throws AmbariException {

      Stage stage = createNewStage(requestStageContainer.getLastStageId(),
        cluster,
        requestStageContainer.getId(),
        "Delete Keytabs",
        StageUtils.getGson().toJson(commandParameters),
        hostParamsJson);

      Collection<ServiceComponentHost> filteredComponents = filterServiceComponentHostsForHosts(
        new ArrayList<>(serviceComponentHosts), hostsWithValidKerberosClient);

      if (!filteredComponents.isEmpty()) {
        List<String> hostsToUpdate = createUniqueHostList(filteredComponents, Collections.singleton(HostState.HEALTHY));

        if (!hostsToUpdate.isEmpty()) {
          Map<String, String> requestParams = new HashMap<>();
          List<RequestResourceFilter> requestResourceFilters = new ArrayList<>();
          RequestResourceFilter reqResFilter = new RequestResourceFilter("KERBEROS", "KERBEROS_CLIENT", hostsToUpdate);
          requestResourceFilters.add(reqResFilter);

          ActionExecutionContext actionExecContext = new ActionExecutionContext(
            cluster.getClusterName(),
            REMOVE_KEYTAB,
            requestResourceFilters,
            requestParams);
          customCommandExecutionHelper.addExecutionCommandsToStage(actionExecContext, stage,
            requestParams, null);
        }
      }

      RoleGraph roleGraph = roleGraphFactory.createNew(roleCommandOrder);
      roleGraph.build(stage);

      requestStageContainer.addStages(roleGraph.getStages());
    }
Send a custom command to the KERBEROS_CLIENT to check if there are missing keytabs on each hosts.
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java