diff --git a/dist/src/main/amoro-bin/bin/ams.sh b/dist/src/main/amoro-bin/bin/ams.sh
index c4ee2eb098..19c9d9ae08 100644
--- a/dist/src/main/amoro-bin/bin/ams.sh
+++ b/dist/src/main/amoro-bin/bin/ams.sh
@@ -43,6 +43,11 @@ JAVA_OPTS="-server -XX:+UseG1GC -XX:MaxGCPauseMillis=200 \
 --add-opens=java.base/sun.util.calendar=ALL-UNNAMED \
 "
 
+# add krb5 module when jdk > 17
+if [ "$JAVA_MAJOR" -ge 17 ] 2>/dev/null; then
+    JAVA_OPTS="${JAVA_OPTS} --add-opens=java.security.jgss/sun.security.krb5=ALL-UNNAMED"
+fi
+
 if [ -n "$JMX_REMOTE_PORT_CONFIG" ];then
   JAVA_OPTS="${JAVA_OPTS} -Dcom.sun.management.jmxremote.port=${JMX_REMOTE_PORT_CONFIG} \
   -Dcom.sun.management.jmxremote \
diff --git a/dist/src/main/amoro-bin/bin/load-config.sh b/dist/src/main/amoro-bin/bin/load-config.sh
index 69dc954621..10cce34319 100644
--- a/dist/src/main/amoro-bin/bin/load-config.sh
+++ b/dist/src/main/amoro-bin/bin/load-config.sh
@@ -17,7 +17,6 @@
 # limitations under the License.
 #
 
-
 CURRENT_DIR="$( cd "$(dirname "$0")" ; pwd -P )"
 AMORO_HOME="$( cd "$CURRENT_DIR/../" ; pwd -P )"
 export AMORO_HOME
@@ -84,3 +83,16 @@ fi
 if [ -n "${HIVE_CONF_DIR}" ]; then
     export AMORO_ADDITION_CLASSPATH=${AMORO_ADDITION_CLASSPATH}:${HIVE_CONF_DIR}
 fi
+
+get_java_major_version() {
+    local version=$($JAVA_RUN -version 2>&1 | head -1 | cut -d'"' -f2)
+    if [[ "$version" == 1.* ]]; then
+        # JDK 8- 1.8.0_xxx → 8
+        echo "$version" | cut -d'.' -f2
+    else
+        # JDK 9+：11.0.x → 11, 17.0.x → 17
+        echo "$version" | cut -d'.' -f1
+    fi
+}
+
+JAVA_MAJOR=$(get_java_major_version)