The HDFS client used by Beam supports Kerberos.
Initial idea: add a flag --hdfs_client that defaults to "INSECURE" and also accepts "KERBEROS". This flag will control initialization of self._hdfs_client.
HDFS client docs:
https://hdfscli.readthedocs.io/en/latest/api.html#module-hdfs.ext.kerberos
The HDFS client seems to use this Kerberos library:
https://pypi.org/project/requests-kerberos/
Imported from Jira BEAM-11750. Original Jira may contain additional context.
Reported by: udim.