diff --git a/tests/templates/kuttl/kerberos/40-access-hbase.j2 b/tests/templates/kuttl/kerberos/40-access-hbase.j2
deleted file mode 100644
index 543f52d0..00000000
--- a/tests/templates/kuttl/kerberos/40-access-hbase.j2
+++ /dev/null
@@ -1,70 +0,0 @@
----
-apiVersion: kuttl.dev/v1beta1
-kind: TestStep
-commands:
-  - script: |
-      kubectl apply -n $NAMESPACE -f - <<EOF
-      ---
-      apiVersion: batch/v1
-      kind: Job
-      metadata:
-        name: access-hbase
-      spec:
-        template:
-          spec:
-            containers:
-              - name: access-hbase
-                image: docker.stackable.tech/stackable/hbase:{{ test_scenario['values']['hbase'] }}-stackable0.0.0-dev
-                env:
-                  - name: HADOOP_CONF_DIR
-                    value: /stackable/conf/hbase
-                  - name: KRB5_CONFIG
-                    value: /stackable/kerberos/krb5.conf
-                  - name: HADOOP_OPTS
-                    value: -Djava.security.krb5.conf=/stackable/kerberos/krb5.conf
-                command:
-                  - /bin/bash
-                  - -c
-                  - |
-                    set -ex
-                    klist -k /stackable/kerberos/keytab
-                    kinit -kt /stackable/kerberos/keytab testuser/access-hbase.$NAMESPACE.svc.cluster.local
-                    klist
-
-                    sleep infinity
-
-                    bin/hdfs dfs -ls /
-                    bin/hdfs dfs -rm -f /hosts
-                    bin/hdfs dfs -put -f /etc/hosts /hosts
-                    bin/hdfs dfs -ls /
-                    bin/hdfs dfs -cat /hosts
-                volumeMounts:
-                  - name: hbase-config
-                    mountPath: /stackable/conf/hbase
-                  - name: kerberos
-                    mountPath: /stackable/kerberos
-            volumes:
-              - name: hbase-config
-                configMap:
-                  name: hbase
-              - name: kerberos
-                ephemeral:
-                  volumeClaimTemplate:
-                    metadata:
-                      annotations:
-                        secrets.stackable.tech/class: kerberos-$NAMESPACE
-                        secrets.stackable.tech/scope: service=access-hbase
-                        secrets.stackable.tech/kerberos.service.names: testuser
-                    spec:
-                      storageClassName: secrets.stackable.tech
-                      accessModes:
-                        - ReadWriteOnce
-                      resources:
-                        requests:
-                          storage: "1"
-            securityContext:
-              fsGroup: 1000
-              runAsGroup: 1000
-              runAsUser: 1000
-            restartPolicy: OnFailure
-      EOF
diff --git a/tests/templates/kuttl/kerberos/40-grant-testuser-access.yaml b/tests/templates/kuttl/kerberos/40-grant-testuser-access.yaml
new file mode 100644
index 00000000..b9586440
--- /dev/null
+++ b/tests/templates/kuttl/kerberos/40-grant-testuser-access.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: kubectl exec -n $NAMESPACE -it hbase-master-default-0 -- bash -c 'klist -kt /stackable/kerberos/keytab && kinit -kt /stackable/kerberos/keytab hbase/hbase.'"$NAMESPACE"'.svc.cluster.local && klist'
+  - script: kubectl exec -n $NAMESPACE -it hbase-master-default-0 -- bash -c "echo -e \"grant 'testuser', 'C';\nexit;\" | bin/hbase shell"
diff --git a/tests/templates/kuttl/kerberos/41-access-hbase.j2 b/tests/templates/kuttl/kerberos/41-access-hbase.j2
new file mode 100644
index 00000000..ea1ee963
--- /dev/null
+++ b/tests/templates/kuttl/kerberos/41-access-hbase.j2
@@ -0,0 +1,113 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      kubectl apply -n $NAMESPACE -f - <<EOF
+      ---
+      apiVersion: batch/v1
+      kind: Job
+      metadata:
+        name: access-hbase
+      spec:
+        template:
+          spec:
+            containers:
+              - name: access-hbase
+                image: docker.stackable.tech/stackable/hbase:{{ test_scenario['values']['hbase'] }}-stackable0.0.0-dev
+                env:
+                  - name: HBASE_CONF_DIR
+                    value: /stackable/conf/hbase
+                  - name: HADOOP_CONF_DIR
+                    value: /stackable/conf/hbase
+                  - name: KRB5_CONFIG
+                    value: /stackable/kerberos/krb5.conf
+                  - name: HBASE_OPTS
+                    value: -Djava.security.krb5.conf=/stackable/kerberos/krb5.conf
+                  - name: NAMESPACE
+                    value: $NAMESPACE
+                command:
+                  - /bin/bash
+                  - /tmp/script/script.sh
+                volumeMounts:
+                  - name: script
+                    mountPath: /tmp/script
+                  - name: hbase-config
+                    mountPath: /stackable/conf/hbase_mount
+                  - name: hdfs-config
+                    mountPath: /stackable/conf/hdfs_mount
+                  - name: config-emptydir
+                    mountPath: /stackable/conf/hbase
+                  - name: kerberos
+                    mountPath: /stackable/kerberos
+            volumes:
+              - name: script
+                configMap:
+                  name: access-hbase-script
+              - name: hbase-config
+                configMap:
+                  name: hbase
+              - name: hdfs-config
+                configMap:
+                  name: hdfs
+              - name: config-emptydir
+                emptyDir: {}
+              - name: kerberos
+                ephemeral:
+                  volumeClaimTemplate:
+                    metadata:
+                      annotations:
+                        secrets.stackable.tech/class: kerberos-$NAMESPACE
+                        secrets.stackable.tech/scope: service=access-hbase
+                        secrets.stackable.tech/kerberos.service.names: testuser
+                    spec:
+                      storageClassName: secrets.stackable.tech
+                      accessModes:
+                        - ReadWriteOnce
+                      resources:
+                        requests:
+                          storage: "1"
+            securityContext:
+              fsGroup: 1000
+              runAsGroup: 1000
+              runAsUser: 1000
+            restartPolicy: OnFailure
+      EOF
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: access-hbase-script
+data:
+  script.sh: |
+    set -ex
+    klist -k /stackable/kerberos/keytab
+    kinit -kt /stackable/kerberos/keytab testuser/access-hbase.$NAMESPACE.svc.cluster.local
+    klist
+
+    export KERBEROS_REALM=$(grep -oP 'default_realm = \K.*' /stackable/kerberos/krb5.conf)
+    cat /stackable/conf/hbase_mount/hbase-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/hbase-site.xml
+    cat /stackable/conf/hdfs_mount/core-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/core-site.xml
+    cat /stackable/conf/hdfs_mount/hdfs-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/hdfs-site.xml
+
+    cat > /tmp/hbase-script << 'EOF'
+    disable 'test';
+    drop 'test';
+
+    create 'test', 'cf1';
+    put 'test', 'row1', 'cf1', 42;
+    put 'test', 'row2', 'cf1', 43;
+    put 'test', 'row3', 'cf1', 44;
+    scan 'test';
+    count 'test';
+    EOF
+
+    if bin/hbase shell /tmp/hbase-script | grep -q '=> 3'; then
+      echo "test passed"
+      exit 0
+    else
+      echo "test failed"
+      echo "Lets re-run to get command output:"
+      bin/hbase shell /tmp/hbase-script
+      exit 1
+    fi
diff --git a/tests/templates/kuttl/kerberos/40-assert.yaml b/tests/templates/kuttl/kerberos/41-assert.yaml
similarity index 100%
rename from tests/templates/kuttl/kerberos/40-assert.yaml
rename to tests/templates/kuttl/kerberos/41-assert.yaml