diff --git a/hieradata/node/azar03.cp.lsst.org.yaml b/hieradata/node/azar03.cp.lsst.org.yaml
index b4499a871d..66f556e96a 100644
--- a/hieradata/node/azar03.cp.lsst.org.yaml
+++ b/hieradata/node/azar03.cp.lsst.org.yaml
@@ -100,3 +100,22 @@ nfs::client_mounts:
     share: "scratch"
     server: "nfs1.cp.lsst.org"
     atboot: true
+  /data:
+    share: "lsstcam"
+    server: "nfs3.cp.lsst.org"
+    atboot: true
+
+profile::core::k5login::k5login:
+  "/home/saluser/.k5login":
+    ensure: "present"
+    principals:
+      - "ccs-ipa/lsstcam-dc01.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc02.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc03.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc04.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc05.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc06.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc07.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc08.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc09.cp.lsst.org@LSST.CLOUD"
+      - "ccs-ipa/lsstcam-dc10.cp.lsst.org@LSST.CLOUD"
diff --git a/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb b/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb
index cf7db0c05a..190c5232fe 100644
--- a/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb
@@ -82,6 +82,9 @@
         it { expect(nm_keyfile['ethernet']['mtu']).to eq(9000) }
       end
 
+      it { is_expected.to contain_class('nfs').with_server_enabled(false) }
+      it { is_expected.to contain_class('nfs').with_client_enabled(true) }
+
       it do
         is_expected.to contain_nfs__client__mount('/net/project').with(
           share: 'project',
@@ -97,6 +100,25 @@
           atboot: true
         )
       end
+
+      it do
+        is_expected.to contain_nfs__client__mount('/data').with(
+          share: 'lsstcam',
+          server: 'nfs3.cp.lsst.org',
+          atboot: true
+        )
+      end
+
+      principals = 1.upto(10).map do |i|
+        format('ccs-ipa/lsstcam-dc%02d.cp.lsst.org@LSST.CLOUD', i)
+      end
+
+      it do
+        is_expected.to contain_k5login('/home/saluser/.k5login').with(
+          ensure: 'present',
+          principals:
+        )
+      end
     end # on os
   end # on_supported_os
 end