I wasted an hour of my life on this (thanks to poor documentation of zookeeper - everything is scattered), I want to make sure no one else does, thankfully someone who knows everything at our workplace helped me out ;)
Do this before you start zkCli -server blahblah:2181

export JVMFLAGS="-Djava.security.auth.login.config=/tmp/jaas.conf -Dsun.net.spi.nameservice.provider.1=dns,sun"

make sure you have jaas conf in tmp folder - I used something like this -

Server {
      org.apache.zookeeper.server.auth.DigestLoginModule required
      user_super="adminsecret"
      user_bob="bobsecret"
      user_dev="devpassword";
    };
    Client{
      org.apache.zookeeper.server.auth.DigestLoginModule required
      username="blah"
      password="blahblah";
    };

it will work now.

jaas.conf file is needed:

Client {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  keyTab="/home/myUser/myUser.keytab"
  storeKey=true
  useTicketCache=false
  principal="myUser@MYREALM.COM";
};

Set environment variables for you current session:
export JVMFLAGS="-Djava.security.auth.login.config=/home/myUser/jaas.conf"
Finally connect to server:
zookeeper-client -server myServerIp
I've written a blog pos t about this as a note to self that should be a bit more complete.

another way to start yarn is to change yarn config:

yarn.resourcemanager.zk-state-store.parent-path /rmstore
yarn.resourcemanager.ha.automatic-failover.zk-base-path /yarn-leader-election

change the path to a new location ,so that zk auth error can be avoid.
FIY： https://hadoop.apache.org/docs/r2.6.0/hadoop-yarn/hadoop-yarn-common/yarn-default.xml