It's possible to configure Kerberos programmatically, but it takes a bit of work: subclass DseGssApiAuthProviderBase, then pass an instance of the subclass to SessionBuilder.withAuthProvider.
Here's an example to inject a programmatic Subject:
We could make this more user-friendly by providing the subclass. We already did for plain-text authentication.
If we don't want to make too many assumptions about which options will be set, we can take a Consumer<GssApiOptions.Builder>> as a constructor argument:
Include an example in the manual.