Currently Lustre clients rely on the lustre_root/<hostname>@REALM principal to authenticate.
Consider supporting the more standard Kerberos machine principal (i.e. host/<hostname>@REALM) as well to avoid the need for additional keytab entries.
This would bring Lustre in line with other services such as OpenSSH and NFS.