protected void fixYarnHsiKerberosDescriptorAndSiteConfig(Cluster cluster, KerberosDescriptor kerberosDescriptor) {
    LOG.info("Updating YARN's HSI Kerberos Descriptor ....");

    // Step 1. Get Hive -> HIVE_SERVER -> 'hive_server_hive' kerberos description for referencing later
    KerberosServiceDescriptor hiveServiceDescriptor = kerberosDescriptor.getService("HIVE");
    KerberosIdentityDescriptor hsh_identityDescriptor = null;
    KerberosPrincipalDescriptor hsh_principalDescriptor = null;
    KerberosKeytabDescriptor hsh_keytabDescriptor = null;
    if (hiveServiceDescriptor != null) {
      KerberosComponentDescriptor hiveServerKerberosDescriptor = hiveServiceDescriptor.getComponent("HIVE_SERVER");
      if (hiveServerKerberosDescriptor != null) {
        hsh_identityDescriptor = hiveServerKerberosDescriptor.getIdentity(HIVE_SERVER_HIVE_KERBEROS_IDENTITY);
        if (hsh_identityDescriptor != null) {
          LOG.info("  Retrieved HIVE->HIVE_SERVER kerberos descriptor. Name = " + hsh_identityDescriptor.getName());
          hsh_principalDescriptor = hsh_identityDescriptor.getPrincipalDescriptor();
          hsh_keytabDescriptor = hsh_identityDescriptor.getKeytabDescriptor();
        }
      }

      // Step 2. Update YARN -> NODEMANAGER's : (1). 'llap_zk_hive' and (2). 'llap_task_hive' kerberos descriptor as reference to
      // HIVE -> HIVE_SERVER -> 'hive_server_hive' (Same as YARN -> NODEMANAGER -> 'yarn_nodemanager_hive_server_hive')
      if (hsh_principalDescriptor != null && hsh_keytabDescriptor != null) {
        KerberosServiceDescriptor yarnServiceDescriptor = kerberosDescriptor.getService("YARN");
        if (yarnServiceDescriptor != null) {
          KerberosComponentDescriptor yarnNmKerberosDescriptor = yarnServiceDescriptor.getComponent("NODEMANAGER");
          if (yarnNmKerberosDescriptor != null) {
            String[] identities = {YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY, YARN_LLAP_TASK_HIVE_KERBEROS_IDENTITY};
            for (String identity : identities) {
              KerberosIdentityDescriptor identityDescriptor = yarnNmKerberosDescriptor.getIdentity(identity);

              KerberosPrincipalDescriptor principalDescriptor = null;
              KerberosKeytabDescriptor keytabDescriptor = null;
              if (identityDescriptor != null) {
                LOG.info("  Retrieved YARN->NODEMANAGER kerberos descriptor to be updated. Name = " + identityDescriptor.getName());
                principalDescriptor = identityDescriptor.getPrincipalDescriptor();
                keytabDescriptor = identityDescriptor.getKeytabDescriptor();

                identityDescriptor.setReference(HIVE_SERVER_KERBEROS_PREFIX + hsh_identityDescriptor.getName());
                LOG.info("    Updated '" + YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY + "' identity descriptor reference = '"
                        + identityDescriptor.getReference() + "'");
                principalDescriptor.setValue(null);
                LOG.info("    Updated '" + YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY + "' principal descriptor value = '"
                        + principalDescriptor.getValue() + "'");

                // Updating keytabs now
                keytabDescriptor.setFile(null);
                LOG.info("    Updated '" + YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY + "' keytab descriptor file = '"
                        + keytabDescriptor.getFile() + "'");
                keytabDescriptor.setOwnerName(null);
                LOG.info("    Updated '" + YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY + "' keytab descriptor owner name = '" + keytabDescriptor.getOwnerName() + "'");
                keytabDescriptor.setOwnerAccess(null);
                LOG.info("    Updated '" + YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY + "' keytab descriptor owner access = '" + keytabDescriptor.getOwnerAccess() + "'");
                keytabDescriptor.setGroupName(null);
                LOG.info("    Updated '" + YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY + "' keytab descriptor group name = '" + keytabDescriptor.getGroupName() + "'");
                keytabDescriptor.setGroupAccess(null);
                LOG.info("    Updated '" + YARN_LLAP_ZK_HIVE_KERBEROS_IDENTITY + "' keytab descriptor group access = '" + keytabDescriptor.getGroupAccess() + "'");

                // Need this as trigger to update the HIVE_LLAP_ZK_SM_KEYTAB_FILE configs later.

                // Get the keytab file 'config name'.
                String[] splits = keytabDescriptor.getConfiguration().split("/");
                if (splits.length == 2) {
                  updateYarnKerberosDescUpdatedList(splits[1]);
                  LOG.info("    Updated 'yarnKerberosDescUpdatedList' = " + getYarnKerberosDescUpdatedList());
                }
              }
            }
          }
        }
      }
    }
  }
Updates YARN's NM 'llap_zk_hive' kerberos descriptor as reference and the associated config
hive-interactive-site/hive.llap.zk.sm.keytab.file
ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog260.java