Date: 2026-02-02
Implemented a host-side Kerberos client fix for service/system users that cannot use KEYRING:persistent credential caches.
/etc/krb5.conf to /etc/krb5.conf.bak-2026-02-02-ccache.default_ccache_name in /etc/krb5.conf:
KEYRING:persistent:%{uid}FILE:/tmp/krb5cc_%{uid}/etc/krb5.conf now points to FILE:/tmp/krb5cc_%{uid}.env -u KRB5CCNAME) resolves default cache as a FILE cache path (/tmp/krb5cc_<uid>).KRB5CCNAME continue using that explicit value until restarted or unset.k8s-nfs-access that failed with:
Invalid UID in persistent keyring name while getting default ccachesudo install -o root -g root -m 0644 /etc/krb5.conf.bak-2026-02-02-ccache /etc/krb5.conf
Run as an operator account with sudo password entry enabled:
sudo -u k8s-nfs-access bash -lc '
set -euo pipefail
kdestroy -A 2>/dev/null || true
kinit -kt /etc/krb5.keytabs/k8s-nfs-access.keytab k8s-nfs-access@AUTH.HOME.LAN
klist
ls -la /mnt/bigdata | head
touch /mnt/bigdata/.k8s_access_principal_test && echo OK_principal_write || echo FAIL_principal_write
rm -f /mnt/bigdata/.k8s_access_principal_test
'