---
title: "Automating Kerberos Keytab Rotation at Uber"
url: https://daily.dev/posts/automating-kerberos-keytab-rotation-at-uber-8urzd5elz
source_url: https://www.uber.com/blog/automating-kerberos-keytab-rotation-at-uber/
type: article
source: "Uber Engineering"
published: 2025-06-18T13:20:04.352Z
updated: 2025-06-18T13:20:32.074Z
tags: ["security", "automation", "authentication", "distributed-systems", "kerberos"]
reading_time: 14
upvotes: 3
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Automating Kerberos Keytab Rotation at Uber

**[Uber Engineering](https://daily.dev/sources/uber)** · 14 min read · 3 upvotes · 0 comments

## Summary

Uber automated the rotation of over 100,000 Kerberos keytabs across their infrastructure by building a custom system that integrates with their Secret Management Platform. The solution addresses key challenges including scale complexity and service disruption risks through failure-domain-aware automation, rate limiting, and careful timing coordination. The system minimizes authentication failures during rotation by ensuring sufficient TGT validity time and maintaining both old and new key versions on servers during transitions. Safety measures include blast radius minimization, cluster-based allowlists for gradual rollout, and automatic deletion capabilities. Uber is now exploring PKINIT as the next evolution to replace keytabs with certificate-based authentication.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.uber.com/blog/automating-kerberos-keytab-rotation-at-uber/>

## Similar posts on daily.dev

- [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments
- [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments
- [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments
- [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments
- [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#automation](https://daily.dev/tags/automation), [#authentication](https://daily.dev/tags/authentication), [#distributed-systems](https://daily.dev/tags/distributed-systems), [#kerberos](https://daily.dev/tags/kerberos)

[View this post on daily.dev](https://daily.dev/posts/automating-kerberos-keytab-rotation-at-uber-8urzd5elz)