private static List<DagCredentialSupplier> defaultCredentialSuppliers() {
    // Class names of credential providers that should be used when adding credentials to the dag.
    // Use plain strings instead of {@link Class#getName()} to avoid compile scope dependencies to other modules.
    List<String> supplierClassNames =
        Collections.singletonList("org.apache.hadoop.hive.kafka.KafkaDagCredentialSupplier");
    List<DagCredentialSupplier> dagSuppliers = new ArrayList<>();
    for (String s : supplierClassNames) {
      try {
        Class<? extends DagCredentialSupplier> c = Class.forName(s).asSubclass(DagCredentialSupplier.class);
        dagSuppliers.add(c.getConstructor().newInstance());
      } catch (ReflectiveOperationException e) {
        LOG.error("Failed to add credential supplier", e);
      }
    }
    return dagSuppliers;
  }
Set up credentials for the base work on secure clusters
ql/src/java/org/apache/hadoop/hive/ql/exec/tez/DagUtils.java