How to connect kerberized Kudu with spark engine cluster mode and impersonation?

[eubnara]

If a spark user wants to connect kerberized kudu, --keytab and --principal should be specified. However, when using impersonation with kyuubi spark engine, it is not suitable to provide client's keytab and principal.
There are some similar conecpt of delegation token in Kudu like authentication token or jwt but it is hard to obtain and distribute those tokens on driver and exeuctors.
Is there any way to connect kerberized kudu?

[pan3793]

Kyuubi also allows using --principal and --keytab to submit the Spark application, but has some restrictions for security purposes. We recommend using the Hadoop impersonation mechanism to simplify the keytab management.

For the impersonation case, the Hadoop Delegation Token plays an important role. Both Kyuubi and Spark have done some work to build the infrastructure to support the Hadoop Delegation Token propagation and renewal, so the first question is, does Kudu support the exact Hadoop Delegation Token, not similar mechanisms? If yes, things would be simpler.