func newHDFSWithKerberosClient(volume models.Volume) (*HDFSClient, error) {
	addresses := strings.Split(volume.Storage.ServerAddresses, ",")
	credential := volume.Credential.HDFSKerberosCredential
	properties := volume.Storage.PropertiesMap
	kerberosClient, err := newKerberosClientWithKeyTab(
		properties[models.KerberosRealm], properties[models.KerberosKDC], credential)
	if err != nil {
		log.Logger.Error("new kerberos client failed, volume id[%s], err[%v]", volume.ID, err)
		return nil, err
	}

	dialFunc := (&net.Dialer{
		Timeout:   time.Duration(HDFSConnTimeOut) * time.Second,
		KeepAlive: 5 * time.Second,
		DualStack: true,
	}).DialContext

	principalName := strings.Split(volume.Storage.PropertiesMap[models.KerberosNameNodePrincipal], "@")[0]
	option := hdfs.ClientOptions{
		Addresses:                    addresses,
		NamenodeDialFunc:             dialFunc,
		DatanodeDialFunc:             dialFunc,
		KerberosClient:               kerberosClient,
		KerberosServicePrincipleName: principalName,
		DataTransferProtection:       volume.Storage.PropertiesMap[models.DataTransferProtection],
	}

	log.Logger.Info("new hdfs kerberos client volume id[%s], options[%+v]", volume.ID, option)
	client, err := hdfs.NewClient(option)
	if err != nil {
		log.Logger.Error("Create HDFS kerberos client failed, volume id[%s], credential[%+v], principalName[%s], err[%v]",
			volume.ID, credential, principalName, err)
		return nil, err
	}
	return &HDFSClient{Client: client}, nil
}