This task should list all the steps to take before enabling Kerberos:
[ ] Create user principals for various teams (probably needs a separate task)
[ ] Create keytabs for all Hadoop daemons - preliminary list in https://wikitech.wikimedia.org/wiki/Analytics/Systems/Kerberos#List_of_principals_and_their_keytabs_for_Hadoop
[x] Kerberize all the nodes that will need it, and deploy keytabs generated in the above step (This can be done separately and it is good to test if kerberos works on all the nodes).
[x] Add analytics users (without SSH access) to all Hadoop worker nodes
[x] Add TLS keys for Master nodes if needed (may be needed only for workers, to be checked)
[x] Add druid and analytics search system users to all Hadoop worker nodes
[x] Disable Meta DB backup to HDFS - T231208
[ ] Find a solution for labstore crons - T234229
[ ] Create Oozie automation to get a snapshot of the current jobs and restart them - T237271
[ ] Prepare Puppet patches to enable kerberos
[ ] Complete https://etherpad.wikimedia.org/p/analytics-kerberos-deployment