Kerberos authentication on dask gateway deployed on AKS

[ketankol]

Is it possible to use Kerberos authentication on a dask gateway deployed on AKS? The documentation says that the FQDN is the fully qualified domain name of the host running dask-gateway-server. But when deployed on AKS, the FQDN can change. What FQDN should we use in that scenario?

# Create the HTTP principal (if not already created)
$ kadmin -q "addprinc -randkey HTTP/FQDN"

# Create a keytab
$ kadmin -q "xst -norandkey -k /etc/dask-gateway/http.keytab HTTP/FQDN"

[ketankol]

Also when we try to use 'Kerberos' authentication, it fails on the gateway server with the error 'Kerberos' not found. Is Kerberos authentication validated and tested?

[consideRatio]

But when deployed on AKS, the FQDN can change.

I think you will need to provide a domain that doesn't change no matter what and doing that it out of scope for this issue.

Action points

• Verify that the required dependencies are available for the Kerberos authentication mechanism is installed in our Dockerfiles
• Validate that such setup is possible assuming there is a domain name exposing the Kerberos server or similar, which is running in the api pod running dask-gateway-server then I assume.