Kerberos kinit cache vs keytab in java to access secure HBase

Question

I am writing a java program to access seured HBase on kerberized cluster. My understanding is I can do it in two ways:

1. Login using principal name and password to create TGT in cache and use it to access the hbase.

2. Using keytab file to access hbase.

before I decide which approach I should take, I want to understand pros and cons of both options. I did google and found this article which explained how both options works. This post also pointed out that TGT from keytab can be renewed by calling checkTGTAndReloginFromKeytab but it did not talk about renewal process for renewing TGT of kinit cache but I think it can be done using renewTGT property in jaas config(correct me if I am wrong). Another point from this post is that kinit cache is only good for short running application since we cannot renew TGT beyond 7 days.

I am leaning towards cache approach since I can securely keep username and password in keyvault and never have to worry about securing keytab. But limitation with this approach is as mentioned earlier, the max length of TGT(7days), I can't use it for long running jobs, at least that's what I understood(correct me).

If you can explain the difference between two or point me to a good article which explains both approach in details, that would be really helpful.

I have written below program to get TGT using username and password.

public static LoginContext kinit() throws LoginException {
    return new LoginContext("Client", callbacks -> {
        for(Callback c : callbacks){
            if(c instanceof NameCallback)
                ((NameCallback) c).setName(username);
            if(c instanceof PasswordCallback)
                ((PasswordCallback) c).setPassword(password);
            }
    });
}


public static void connectToKerberizedHBase(Configuration conf) throws LoginException, IOException {
    UserGroupInformation.setConfiguration(conf);

    LoginContext lc = kinit();
    lc.login();
    UserGroupInformation.loginUserFromSubject(lc.getSubject());
}

Using it as below

somemethod(){
    Configuration config = HBaseConfiguration.create();
    loadHBaseConfigsFromProperties(config);//to load zookeeper quorum, port etc...
    connectToKerberizedHBase(config);
}

JAAS Config file:

Client {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=false
    renewTGT=true
    useTicketCache=true;
};

The above mentioned article also talks about delegates using keytab which I didn't understand so please help me to understand if that is the right to create connection for long running jobs?