chore(k3s): rename prole-*.yaml manifests to knoe-* and align contents

Mirrors commit b355855 (auth-side rename). The kustomization at
deploy/opentofu/k3s/manifests/knoe/kustomization.yaml has been
referencing knoe-* names since the rebrand; kustomize was broken
on the k3s deploy mode until this lands.

Five git mv:
  prole-configmap.yaml           -> knoe-configmap.yaml
  prole-deployment.yaml          -> knoe-deployment.yaml
  prole-service.yaml             -> knoe-service.yaml
  prole-kdc-configmap.yaml       -> knoe-kdc-configmap.yaml
  prole-kdc-secrets.example.yaml -> knoe-kdc-secrets.example.yaml

Plus content sweep of knoe-kdc-configmap.yaml: replaced stale
PROLE.LOCAL/PROLE.ORG realm refs and PROLE_KDC_* env vars with
KNOE.DEV/KNOE_KDC_* to match the canonical GKE configmap.

Closes queue item #2 in docs/TODO.md (drift R5).

Co-authored-by: Junie <junie@jetbrains.com>

deploy/opentofu/k3s/manifests/knoe/knoe-kdc-configmap.yaml

@@ -5,33 +5,26 @@ metadata:
 data:
   krb5.conf: |
     [libdefaults]
-      default_realm = PROLE.LOCAL
+      default_realm = KNOE.DEV
       dns_lookup_realm = false
       dns_lookup_kdc = false
-
+      ticket_lifetime = 10h
+      renew_lifetime = 7d
+      forwardable = true
     [realms]
-      PROLE.LOCAL = {
+      KNOE.DEV = {
         kdc = 127.0.0.1
         admin_server = 127.0.0.1
       }
-      PROLE.ORG = {
-        kdc = myrddin.prole.org
-        admin_server = myrddin.prole.org
-      }
-
-    [capaths]
-      PROLE.LOCAL = {
-        PROLE.ORG = .
-      }
-      PROLE.ORG = {
-        PROLE.LOCAL = .
-      }
+    [domain_realm]
+      .knoe.dev = KNOE.DEV
+      knoe.dev  = KNOE.DEV
   kdc.conf: |
     [kdcdefaults]
       kdc_ports = 88
       kdc_tcp_ports = 88
     [realms]
-      PROLE.LOCAL = {
+      KNOE.DEV = {
         database_name = /var/lib/krb5kdc/principal
         admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
         acl_file = /etc/krb5kdc/kadm5.acl
@@ -41,28 +34,25 @@ data:
         default_principal_flags = +preauth
       }
   kadm5.acl: |
-    admin/admin@PROLE.LOCAL *
+    admin/admin@KNOE.DEV *
   entrypoint.sh: |
     #!/usr/bin/env bash
     set -euo pipefail
     export DEBIAN_FRONTEND=noninteractive
-
-    realm="${PROLE_KDC_REALM:-PROLE.ORG}"
-    admin_principal="${PROLE_KDC_ADMIN_PRINCIPAL:-admin/admin}"
+    realm="${KNOE_KDC_REALM:-KNOE.DEV}"
+    admin_principal="${KNOE_KDC_ADMIN_PRINCIPAL:-admin/admin}"
     if [[ "${admin_principal}" != *"@"* ]]; then
       admin_principal="${admin_principal}@${realm}"
     fi
-
     if ! command -v krb5kdc >/dev/null 2>&1; then
       echo "Installing Kerberos packages..."
       echo "krb5-config krb5-config/default_realm string ${realm}" | debconf-set-selections || true
       echo "krb5-config krb5-config/kerberos_servers string 127.0.0.1" | debconf-set-selections || true
       echo "krb5-config krb5-config/admin_server string 127.0.0.1" | debconf-set-selections || true
-      apt-get update
+      apt-get update -qq
       apt-get install -y --no-install-recommends krb5-kdc krb5-admin-server krb5-user dnsutils ca-certificates
       rm -rf /var/lib/apt/lists/*
     fi
-
     mkdir -p /etc/krb5kdc /var/lib/krb5kdc
     if [[ -f /opt/knoe-kdc/krb5.conf ]]; then
       cp /opt/knoe-kdc/krb5.conf /etc/krb5.conf
@@ -73,43 +63,37 @@ data:
     if [[ -f /opt/knoe-kdc/kadm5.acl ]]; then
       cp /opt/knoe-kdc/kadm5.acl /etc/krb5kdc/kadm5.acl
     fi
-
-    if [[ -z "${PROLE_KDC_MASTER_PASSWORD:-}" ]]; then
-      echo "ERROR: Missing required env PROLE_KDC_MASTER_PASSWORD (secret 'knoe-kdc-secrets/master_password')." >&2
+    if [[ -z "${KNOE_KDC_MASTER_PASSWORD:-}" ]]; then
+      echo "ERROR: Missing required env KNOE_KDC_MASTER_PASSWORD" >&2
       exit 1
     fi
-    if [[ -z "${PROLE_KDC_ADMIN_PASSWORD:-}" ]]; then
-      echo "ERROR: Missing required env PROLE_KDC_ADMIN_PASSWORD (secret 'knoe-kdc-secrets/admin_password')." >&2
+    if [[ -z "${KNOE_KDC_ADMIN_PASSWORD:-}" ]]; then
+      echo "ERROR: Missing required env KNOE_KDC_ADMIN_PASSWORD" >&2
       exit 1
     fi
-
     if [[ ! -f /var/lib/krb5kdc/principal ]]; then
       echo "Initializing realm database for ${realm}..."
-      kdb5_util create -s -r "${realm}" -P "${PROLE_KDC_MASTER_PASSWORD}"
+      kdb5_util create -s -r "${realm}" -P "${KNOE_KDC_MASTER_PASSWORD}"
     fi
-
     if ! kadmin.local -q "get_principal ${admin_principal}" >/dev/null 2>&1; then
       echo "Creating admin principal ${admin_principal}..."
-      kadmin.local -q "addprinc -pw ${PROLE_KDC_ADMIN_PASSWORD} ${admin_principal}"
+      kadmin.local -q "addprinc -pw ${KNOE_KDC_ADMIN_PASSWORD} ${admin_principal}"
     fi
-
-    # admin user principal for UI login (uses master password)
+    # system admin user principal
     if ! kadmin.local -q "get_principal admin@${realm}" >/dev/null 2>&1; then
       echo "Creating admin user principal admin@${realm}..."
-      kadmin.local -q "addprinc -pw ${PROLE_KDC_MASTER_PASSWORD} admin@${realm}"
+      kadmin.local -q "addprinc -pw ${KNOE_KDC_MASTER_PASSWORD} admin@${realm}"
     fi
-
     # guest user principal (read-only)
     if ! kadmin.local -q "get_principal guest@${realm}" >/dev/null 2>&1; then
       echo "Creating guest user principal guest@${realm}..."
-      kadmin.local -q "addprinc -pw ${PROLE_KDC_GUEST_PASSWORD:-changeme} guest@${realm}"
+      kadmin.local -q "addprinc -pw ${KNOE_KDC_GUEST_PASSWORD:-changeme} guest@${realm}"
     fi
-
     echo "Starting krb5kdc and kadmind ..."
     krb5kdc -n &
     sleep 0.5
     if ! pgrep -x krb5kdc >/dev/null 2>&1; then
-      echo "ERROR: krb5kdc failed to start. Check /var/log/ (syslog) for details." >&2
+      echo "ERROR: krb5kdc failed to start." >&2
       exit 1
     fi
     exec kadmind -nofork