The service principal name added to `/etc/krb5.keytab` had a trailing `}` character because of a typo in the Ansible task. This resulted in GSSAPI authentication failing because server processes could not find the host key in the key table.
Dustin
984628cbbc