make kerberos recipe idempotent. use configurable runtimes for everything.