The cookbook treats all versions of CDAP the same for Kerberos. However, different versions of CDAP had different requirements. The cookbook should be updated to use the correct requirements on the correct versions, versus the current one-size-fits-all approach which could potentially mask issues in testing.
To clean this up properly, we should probably major version bump the cookbook and remove the cruft to support older attributes. This will make it much cleaner as we'll simply only support the cdap-site.xml settings.