chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 11:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(knoe-users): auto-recover KDC database when pod restarted with EmptyDir

Browse Source 
When the KDC pod restarts (e.g. after k3d node restart to apply registry
mirror config), its EmptyDir volume is wiped. ensure_kdc_pod() finds the
running pod and returns it, bypassing the bootstrap path. The subsequent
pre-flight check then fails because kadmin.local cannot access the database.

Instead of dying with a manual-intervention message, auto-recover by calling
init_kdc.sh initialize (with PROLE_KDC_NAMESPACE/NAME/MASTER_PASSWORD set)
then retrying the pre-flight. Only die if the retry also fails.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
chrisfu 2026-05-03 15:38:18 -07:00
parent 96964b0a2b
commit 7466bbee3a
1 changed files with 19 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
etc/init_knoe_users.sh
View File

@ -286,16 +286,29 @@ initialize() {
# 2a. Pre-flight: verify the KDC database stash file is present and kadmin.local
# can access the database. A missing stash means init_kdc.sh has not been
# run (or the pod restarted with ephemeral storage).
# run (or the pod restarted with ephemeral storage — EmptyDir volumes are
# wiped on pod restart). Auto-recover by re-initialising the database.
log "Verifying KDC database accessibility ..."
if ! kubectl -n "$KNOE_KDC_NAMESPACE" exec "$kdc_pod" -c kdc -- \
sh -c 'kadmin.local -q listprincs' >/dev/null 2>&1; then
die "KDC database not accessible in pod ${kdc_pod}.
The KDC master-key stash file is missing or the database has not been initialised.
Resolve by running: ./etc/init_kdc.sh initialize
Then click 'Provision Users & Auth' again."
log "KDC database not accessible — pod may have restarted with ephemeral storage."
log "Re-initialising KDC database via init_kdc.sh ..."
local init_kdc_script="$SCRIPT_DIR/init_kdc.sh"
[[ -f "$init_kdc_script" ]] || die "Required script not found: $init_kdc_script"
PROLE_KDC_NAMESPACE="$KNOE_KDC_NAMESPACE" \
PROLE_KDC_MASTER_PASSWORD="$PROLE_KDC_MASTER_PASSWORD" \
PROLE_KDC_NAME="$KNOE_AUTH_DEPLOYMENT" \
bash "$init_kdc_script" initialize >&2
# Retry pre-flight after re-init
if ! kubectl -n "$KNOE_KDC_NAMESPACE" exec "$kdc_pod" -c kdc -- \
sh -c 'kadmin.local -q listprincs' >/dev/null 2>&1; then
die "KDC database still not accessible after re-initialisation in pod ${kdc_pod}.
Check init_kdc.sh logs above for errors."
fi
log "KDC database re-initialised successfully"
else
log "KDC database accessible"
fi
log "KDC database accessible"
# 3. Create admin@PROLE.LOCAL (UI login with master password)
local admin_princ="${KNOE_ADMIN_PRINCIPAL}@${PROLE_KDC_REALM}"