Global – November 10, 2026 -- Warewulf Pro 4.7 keeps stateless compute nodes joined to Active Directory across reboots by moving the join to the Warewulf server, using two overlays shipped in the warewulf-overlays-sssd package. Nodes never run realm join; the join happens once per node on the server.
Two overlays carry the join to every booting node
Warewulf nodes boot from a network-served image, so anything written to the root filesystem at runtime, including a realm join, disappears on reboot. The sssd system overlay configures SSSD and the Kerberos default realm on each node. The krb5.keytab runtime overlay delivers each node's Kerberos keytab from the server.
The node image needs the sssd, sssd-ad, adcli, krb5-workstation and authselect packages, with SSSD selected as the authentication profile. Not every Warewulf node image includes authselect, so it must be installed explicitly.
Secure mode restricts keytab delivery to root on the node
A keytab lets its holder authenticate to AD as that node. By default, Warewulf serves overlays to anyone on the provisioning network who asks. Setting secure: true in /etc/warewulf/warewulf.conf makes it serve the runtime overlay only to requests from a privileged port, meaning only root on the node can fetch it. That is why the keytab ships in a runtime overlay rather than a system overlay.
One adcli join per node creates the computer account and keytab
Each node needs its own AD computer account, created from the server with adcli. Keytabs are stored under /etc/warewulf/keytabs and also saved in base64, because Warewulf's template Include function strips a trailing newline byte and would corrupt a raw keytab ending in 0x0a.
For larger clusters, an administrator obtains a Kerberos ticket once with kinit and passes it to each join with --login-ccache, avoiding a password prompt per node. The source's example loops over 100 nodes. AD computer names are limited to 15 characters.
The only required configuration tag is sssd_domain. The realm defaults to the upper-case domain, and home directories default to /home/%u@%d.
SSSD starts after wwclient so the keytab exists first
With secure mode on, the keytab arrives a few seconds into boot. The sssd overlay orders SSSD to start after wwclient, preventing it from launching before the keytab is present. Nothing needs to be redone after a reboot.
Home directories must exist on the NFS host before first login
Warewulf's default profile mounts /home over NFS from the server with root_squash, so root on a node cannot create directories there. Administrators must create each user's home directory on the hosting system before first login, or the login fails with "Could not chdir to home directory". If /home is local or writable by node root, oddjob-mkhomedir can create directories at first login instead. On a stateless node, a local /home lives in memory and is cleared on every reboot unless a local disk is mounted.
Password rotation moves from the nodes to the server
The overlay disables machine password rotation on nodes. The server's keytab is the source of truth, and wwclient reapplies the runtime overlay every minute by default, so a keytab rotated on a node would be overwritten, leaving the node with a password AD no longer accepts.
Where policy requires rotation, administrators run adcli update on the server with --computer-password-lifetime=0; without it, adcli skips accounts whose password is under 30 days old. They must then rebuild the node's overlays, because Warewulf does not detect changes to the keytab files the overlay reads. The running node picks up the new keytab within a minute without a reboot, though logins can fail on that node in the interim.
The package also installs warewulf-krb5-rotate, which automates these steps. Each node authenticates with its own keytab, so no administrator credentials are stored on the server. A daily timer rotates each tagged node whose keytab file is older than krb5_rotate_days, which defaults to 30, then rebuilds its overlays and reloads wwclient.