In Kerberos, anyone can request a ticket-granting ticket (TGT) from the server, and the server will respond with a ticket if the user exists. The request is in cleartext, and the resulting ticket is composed of two parts: a session key, which is encrypted with the hash of the user's password, and the TGT, which is encrypted with the session key.
If the user's password is insecure, then an attacker can brute-force the password and then discover the session key, and then decrypt the TGT. This can be done offline.
A Kerberoasting attack is simply an attack in which the attacker compromises an ordinary user account, and then uses that user account to request service tickets. If the service account also uses static, insecure passwords, then it's possible to attack them offline and compromise the service by brute-forcing the password. Because services often have access to other services, this is a good way to gain additional privileges. It's essentially a way to gain additional access once a compromise has already occurred.
This attack mostly happens against Active Directory systems because typically systems using MIT Kerberos have static, but cryptographically secure keys which are deployed directly to the service machine. Thus, because the service secret contains sufficient entropy, it's computationally infeasible to brute force. You could gain the same benefits with Active Directory by making sure all service principals use passwords with sufficient entropy. For example, the hex-encoded SHA-256 hash of sufficient CSPRNG output would be a good password. Since it's only being used by a machine and not a human, the fact that it's difficult to memorize or type isn't really a problem.
There is an article describing the idea of the Kerberoasting attack and the Wikipedia article on Kerberos describes the protocol in substantial detail.
