krb_server_keyfile

krb_server_keyfile is the PostgreSQL setting that defines the location of the Kerberos server key file.

Note

Fact — official short description: “Sets the location of the Kerberos server key file.”

Identity

Type , Valuestring: Upstream pg_settings type
Context , Valuesighup: Takes effect after configuration reload
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueConnections and Authentication / Authentication: Upstream classification
Latest boot value , ValueFILE:/etc/postgresql-common/krb5.keytab: FILE:/etc/postgresql-common/krb5.keytab

Lifecycle

Fact	Value
First observed	PG9.0 (research boundary)
Present in	PG9.0–19 Beta 3
Removed in	No
Introduction commit	Not asserted: predates the PG9.0 research boundary
Commit date	—
Discussion	—

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG9.0	`""`	—	empty string
PG9.1–19 Beta 3	`FILE:/etc/postgresql-common/krb5.keytab`	—	FILE:/etc/postgresql-common/krb5.keytab

How it works

krb_server_keyfile sets the location of the Kerberos server key file. The file contains service keys used by GSSAPI authentication; operating-system ownership and keytab rotation are part of the effective configuration.

krb_server_keyfile is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value.

The final authentication path combines this setting with pg_hba.conf, role attributes, credential material, client capabilities, and sometimes operating-system identity services.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Set krb_server_keyfile from the authentication architecture and security policy, not workload throughput. Test every driver, identity mapping, failover path, and credential-rotation procedure.
OLAP	Apply the same security baseline to analytical access; isolate any legacy client exception to a dedicated role and a dated migration plan.
Small nodes	Prefer the current secure default for krb_server_keyfile. Avoid weakening authentication to save marginal CPU on a small node; reduce connection churn with pooling instead.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG9.0–19 Beta 3 unmodified; OLAP: PG9.0–19 Beta 3 unmodified; CRIT: PG9.0–19 Beta 3 unmodified; TINY: PG9.0–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Editing krb_server_keyfile without reloading configuration and verifying the effective value and subsequent behavior.
Changing one authentication setting without testing pg_hba.conf ordering, existing secrets, mappings, and every client library.
Weakening identity policy to solve connection churn or CPU cost that should be addressed with pooling and capacity planning.
Changing krb_server_keyfile globally without a rollback plan and a client or operational compatibility test.

password_encryption · scram_iterations · md5_password_warnings · authentication_timeout · oauth_validator_libraries