The service principal keys definitely are used to encrypt the service ticket that the client sends to the server to authenticate itself.   I'm not 100% sure why it's not showing up in the klist. The short technical answer is that the hadoop CLIs are not using the user key cache to cache the service tickets. If there is a reason why they don't, it's a reason I have forgotten or never knew. ... View more