chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 16:44:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(auth): init scripts and k3s/k8s auth manifests for knoe-auth

Browse Source 
init_knoe_auth.sh: provisions KDC secrets via 1Password, applies GKE manifests
init_knoe_users.sh: creates Kerberos principals for initial contributors
kerberos-configmap.yaml: krb5.conf for OpenBao Kerberos auth (KNOE.DEV realm)
prole-auth-deployment.yaml: k3s auth + kdc sidecar deployment for homelab
prole-kdc-configmap.yaml: k3s KDC config for homelab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
chrisfu 2026-04-27 14:08:18 -07:00
parent 1417bc51f0
commit 40ea30e4c3
5 changed files with 356 additions and 865 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
deploy/opentofu/k3s/manifests/knoe/prole-auth-deployment.yaml
View File

@ -16,7 +16,7 @@ spec:
spec: spec:
initContainers: initContainers:
- name: keytab-bootstrap - name: keytab-bootstrap
image: myrddin.knoe.org:5000/knoe-authority:latest image: myrddin.prole.org:5000/knoe-authority:latest
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- /bin/bash - /bin/bash
@ -202,7 +202,7 @@ spec:
subPath: krb5.conf subPath: krb5.conf
readOnly: true readOnly: true
- name: kdc - name: kdc
image: myrddin.knoe.org:5000/knoe-authority:latest image: myrddin.prole.org:5000/knoe-authority:latest
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: ["/bin/bash", "/opt/knoe-kdc/entrypoint.sh"] command: ["/bin/bash", "/opt/knoe-kdc/entrypoint.sh"]
env: env:

4
deploy/opentofu/k3s/manifests/knoe/prole-kdc-configmap.yaml
View File

@ -15,8 +15,8 @@ data:
admin_server = 127.0.0.1 admin_server = 127.0.0.1
} }
PROLE.ORG = { PROLE.ORG = {
kdc = myrddin.knoe.org kdc = myrddin.prole.org
admin_server = myrddin.knoe.org admin_server = myrddin.prole.org
} }
[capaths] [capaths]

1195
etc/init_knoe_auth.sh
View File

File diff suppressed because it is too large Load Diff

14
etc/init_knoe_users.sh
View File

@ -7,14 +7,14 @@ set -euo pipefail
# - Provision Kerberos principals and database accounts for knoe-system users # - Provision Kerberos principals and database accounts for knoe-system users
# - Creates: admin@PROLE.LOCAL (master password), guest@PROLE.LOCAL (read-only), # - Creates: admin@PROLE.LOCAL (master password), guest@PROLE.LOCAL (read-only),
# postgres service principal (keytab for GSS auth), developer group role # postgres service principal (keytab for GSS auth), developer group role
# - Cross-realm trust with myrddin.knoe.org PROLE.ORG is activated via # - Cross-realm trust with myrddin.prole.org PROLE.ORG is activated via
# PROLE_KDC_TRUST_REALM=PROLE.ORG in init_kdc.sh / init_knoe_auth.sh # PROLE_KDC_TRUST_REALM=PROLE.ORG in init_kdc.sh / init_knoe_auth.sh
# - Sets up service admin access: ArgoCD RBAC, Gitea, GitLab # - Sets up service admin access: ArgoCD RBAC, Gitea, GitLab
# #
# Prerequisites: # Prerequisites:
# init_kdc.sh initialize (with PROLE_KDC_REALM=PROLE.LOCAL, # init_kdc.sh initialize (with PROLE_KDC_REALM=PROLE.LOCAL,
# PROLE_KDC_TRUST_REALM=PROLE.ORG, # PROLE_KDC_TRUST_REALM=PROLE.ORG,
# KRB5_KDC=myrddin.knoe.org) # KRB5_KDC=myrddin.prole.org)
# init_cnpg_backup.sh (CNPG cluster must exist) # init_cnpg_backup.sh (CNPG cluster must exist)
# init_argocd.sh (ArgoCD must be running) # init_argocd.sh (ArgoCD must be running)
# #
@ -93,8 +93,8 @@ KNOE_DEPLOYMENT_MODE="${KNOE_DEPLOYMENT_MODE:-$(resolve_knoe_mode)}"
KNOE_AUTH_DEPLOYMENT="${KNOE_AUTH_DEPLOYMENT:-${PROLE_KDC_NAME:-$(default_knoe_auth_deployment)}}" KNOE_AUTH_DEPLOYMENT="${KNOE_AUTH_DEPLOYMENT:-${PROLE_KDC_NAME:-$(default_knoe_auth_deployment)}}"
KNOE_ADMIN_PRINCIPAL="${KNOE_ADMIN_PRINCIPAL:-admin}" KNOE_ADMIN_PRINCIPAL="${KNOE_ADMIN_PRINCIPAL:-admin}"
PROLE_KDC_REALM="${PROLE_KDC_REALM:-PROLE.LOCAL}" PROLE_KDC_REALM="${PROLE_KDC_REALM:-PROLE.LOCAL}"
GITEA_HOST="${GITEA_HOST:-git.knoe.org}" GITEA_HOST="${GITEA_HOST:-git.prole.org}"
GITLAB_HOST="${GITLAB_HOST:-gitlab.knoe.org}" GITLAB_HOST="${GITLAB_HOST:-gitlab.prole.org}"
GITEA_NAMESPACE="${GITEA_NAMESPACE:-gitea}" GITEA_NAMESPACE="${GITEA_NAMESPACE:-gitea}"
GITLAB_NAMESPACE="${GITLAB_NAMESPACE:-gitlab}" GITLAB_NAMESPACE="${GITLAB_NAMESPACE:-gitlab}"
ARGOCD_NAMESPACE="${ARGOCD_NAMESPACE:-argocd}" ARGOCD_NAMESPACE="${ARGOCD_NAMESPACE:-argocd}"
@ -455,8 +455,8 @@ SQL
# 8. Create knoe.user schema tables and bootstrap users # 8. Create knoe.user schema tables and bootstrap users
if [[ -n "$primary" ]]; then if [[ -n "$primary" ]]; then
create_knoe_schema "$primary" create_knoe_schema "$primary"
provision_user "$primary" "chrisfu" "chrisfu@knoe.org" "Chris Fu" "admin" provision_user "$primary" "chrisfu" "chrisfu@prole.org" "Chris Fu" "admin"
provision_user "$primary" "ron" "ron@knoe.org" "Ron" "developer" provision_user "$primary" "ron" "ron@prole.org" "Ron" "developer"
else else
warn "CNPG primary not found — skipping knoe.user schema and user provisioning" warn "CNPG primary not found — skipping knoe.user schema and user provisioning"
fi fi
@ -473,7 +473,7 @@ SQL
log "=== Initialization complete ===" log "=== Initialization complete ==="
log "" log ""
log "Next steps:" log "Next steps:"
log " 1. On myrddin.knoe.org: add krbtgt/PROLE.LOCAL@PROLE.ORG trust principal" log " 1. On myrddin.prole.org: add krbtgt/PROLE.LOCAL@PROLE.ORG trust principal"
log " (samba-tool domain trust or equivalent, using trust_shared_password from knoe-kdc-secrets)" log " (samba-tool domain trust or equivalent, using trust_shared_password from knoe-kdc-secrets)"
log " 2. Confirm Grafana auth.proxy configured with: headers = Role:X-Knoe-Groups" log " 2. Confirm Grafana auth.proxy configured with: headers = Role:X-Knoe-Groups"
log " 3. After admin logs in to Gitea/GitLab for the first time, re-run: $0 initialize" log " 3. After admin logs in to Gitea/GitLab for the first time, re-run: $0 initialize"

4
k8s/openbao/kerberos-configmap.yaml
View File

@ -17,5 +17,5 @@ data:
} }
[domain_realm] [domain_realm]
.knoe.org = PROLE.ORG .prole.org = PROLE.ORG
knoe.org = PROLE.ORG prole.org = PROLE.ORG