如果您使用的是distcp，那么您必须确保kdc的两个集群相互了解，方法是编辑krb5.conf，在每个集群上添加[realms]和[domain\u realms]，以了解另一个集群，如下所示：

[realms]
        <CLUSTER2_REALM> = {
                kdc = <cluster2_server_kdc_host>:88
                admin_server = <cluster2_server_kdc_host>:749
                default_domain = <cluster2_host>
        }
[domain_realm]
        Clustre2_NN1 = CLUSTER2_REALM
        Cluster2_NN2= CLUSTER2_REALM

cluster2也是如此，cluster1的细节也是如此。
然后需要在两个集群上创建主体

addprinc -e "aes128-cts-hmac-sha1-96:normal aes256-cts-hmac-sha1-96:normal" krbtgt/<CLUSTER1_REASLM>@<CLUSTER2_REALMS>

modprinc -maxrenewlife <n>day krbtgt/<CLUSTER1_REALM>@<CLUSTER2_REALM>

需要为hadoop.security.auth\u to\u local设置以下属性

In Cluster1:
RULE:[1:$1@$0](.*@\Q<CLUSTER2_REALM>\E$)s/@\Q<CLUSTER2_REALM>\E$//
RULE:[2:$1@$0](.*@\Q<CLUSTER2_REALM>\E$)s/@\Q<CLUSTER2_REALM>\E$//
In Cluster2:
RULE:[1:$1@$0](.*@\Q<CLUSTER1_REALM>\E$)s/@\Q<CLUSTER1_REALM>\E$//
RULE:[2:$1@$0](.*@\Q<CLUSTER1_REALM>\E$)s/@\Q<CLUSTER1_REALM>\E$//

重新启动kdc

/etc/init.d/krb5kdc stop
/etc/init.d/kadmin stop
/etc/init.d/krb5kdc start
/etc/init.d/kadmin start

故障转移或重新启动namenodes