diff --git a/deploy/opentofu/k3s/manifests/knoe/prole-configmap.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-configmap.yaml similarity index 100% rename from deploy/opentofu/k3s/manifests/knoe/prole-configmap.yaml rename to deploy/opentofu/k3s/manifests/knoe/knoe-configmap.yaml diff --git a/deploy/opentofu/k3s/manifests/knoe/prole-deployment.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-deployment.yaml similarity index 100% rename from deploy/opentofu/k3s/manifests/knoe/prole-deployment.yaml rename to deploy/opentofu/k3s/manifests/knoe/knoe-deployment.yaml diff --git a/deploy/opentofu/k3s/manifests/knoe/prole-kdc-configmap.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-kdc-configmap.yaml similarity index 66% rename from deploy/opentofu/k3s/manifests/knoe/prole-kdc-configmap.yaml rename to deploy/opentofu/k3s/manifests/knoe/knoe-kdc-configmap.yaml index ff83fc9..2c0632c 100644 --- a/deploy/opentofu/k3s/manifests/knoe/prole-kdc-configmap.yaml +++ b/deploy/opentofu/k3s/manifests/knoe/knoe-kdc-configmap.yaml @@ -5,33 +5,26 @@ metadata: data: krb5.conf: | [libdefaults] - default_realm = PROLE.LOCAL + default_realm = KNOE.DEV dns_lookup_realm = false dns_lookup_kdc = false - + ticket_lifetime = 10h + renew_lifetime = 7d + forwardable = true [realms] - PROLE.LOCAL = { + KNOE.DEV = { kdc = 127.0.0.1 admin_server = 127.0.0.1 } - PROLE.ORG = { - kdc = myrddin.prole.org - admin_server = myrddin.prole.org - } - - [capaths] - PROLE.LOCAL = { - PROLE.ORG = . - } - PROLE.ORG = { - PROLE.LOCAL = . - } + [domain_realm] + .knoe.dev = KNOE.DEV + knoe.dev = KNOE.DEV kdc.conf: | [kdcdefaults] kdc_ports = 88 kdc_tcp_ports = 88 [realms] - PROLE.LOCAL = { + KNOE.DEV = { database_name = /var/lib/krb5kdc/principal admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab acl_file = /etc/krb5kdc/kadm5.acl @@ -41,28 +34,25 @@ data: default_principal_flags = +preauth } kadm5.acl: | - admin/admin@PROLE.LOCAL * + admin/admin@KNOE.DEV * entrypoint.sh: | #!/usr/bin/env bash set -euo pipefail export DEBIAN_FRONTEND=noninteractive - - realm="${PROLE_KDC_REALM:-PROLE.ORG}" - admin_principal="${PROLE_KDC_ADMIN_PRINCIPAL:-admin/admin}" + realm="${KNOE_KDC_REALM:-KNOE.DEV}" + admin_principal="${KNOE_KDC_ADMIN_PRINCIPAL:-admin/admin}" if [[ "${admin_principal}" != *"@"* ]]; then admin_principal="${admin_principal}@${realm}" fi - if ! command -v krb5kdc >/dev/null 2>&1; then echo "Installing Kerberos packages..." echo "krb5-config krb5-config/default_realm string ${realm}" | debconf-set-selections || true echo "krb5-config krb5-config/kerberos_servers string 127.0.0.1" | debconf-set-selections || true echo "krb5-config krb5-config/admin_server string 127.0.0.1" | debconf-set-selections || true - apt-get update + apt-get update -qq apt-get install -y --no-install-recommends krb5-kdc krb5-admin-server krb5-user dnsutils ca-certificates rm -rf /var/lib/apt/lists/* fi - mkdir -p /etc/krb5kdc /var/lib/krb5kdc if [[ -f /opt/knoe-kdc/krb5.conf ]]; then cp /opt/knoe-kdc/krb5.conf /etc/krb5.conf @@ -73,43 +63,37 @@ data: if [[ -f /opt/knoe-kdc/kadm5.acl ]]; then cp /opt/knoe-kdc/kadm5.acl /etc/krb5kdc/kadm5.acl fi - - if [[ -z "${PROLE_KDC_MASTER_PASSWORD:-}" ]]; then - echo "ERROR: Missing required env PROLE_KDC_MASTER_PASSWORD (secret 'knoe-kdc-secrets/master_password')." >&2 + if [[ -z "${KNOE_KDC_MASTER_PASSWORD:-}" ]]; then + echo "ERROR: Missing required env KNOE_KDC_MASTER_PASSWORD" >&2 exit 1 fi - if [[ -z "${PROLE_KDC_ADMIN_PASSWORD:-}" ]]; then - echo "ERROR: Missing required env PROLE_KDC_ADMIN_PASSWORD (secret 'knoe-kdc-secrets/admin_password')." >&2 + if [[ -z "${KNOE_KDC_ADMIN_PASSWORD:-}" ]]; then + echo "ERROR: Missing required env KNOE_KDC_ADMIN_PASSWORD" >&2 exit 1 fi - if [[ ! -f /var/lib/krb5kdc/principal ]]; then echo "Initializing realm database for ${realm}..." - kdb5_util create -s -r "${realm}" -P "${PROLE_KDC_MASTER_PASSWORD}" + kdb5_util create -s -r "${realm}" -P "${KNOE_KDC_MASTER_PASSWORD}" fi - if ! kadmin.local -q "get_principal ${admin_principal}" >/dev/null 2>&1; then echo "Creating admin principal ${admin_principal}..." - kadmin.local -q "addprinc -pw ${PROLE_KDC_ADMIN_PASSWORD} ${admin_principal}" + kadmin.local -q "addprinc -pw ${KNOE_KDC_ADMIN_PASSWORD} ${admin_principal}" fi - - # admin user principal for UI login (uses master password) + # system admin user principal if ! kadmin.local -q "get_principal admin@${realm}" >/dev/null 2>&1; then echo "Creating admin user principal admin@${realm}..." - kadmin.local -q "addprinc -pw ${PROLE_KDC_MASTER_PASSWORD} admin@${realm}" + kadmin.local -q "addprinc -pw ${KNOE_KDC_MASTER_PASSWORD} admin@${realm}" fi - # guest user principal (read-only) if ! kadmin.local -q "get_principal guest@${realm}" >/dev/null 2>&1; then echo "Creating guest user principal guest@${realm}..." - kadmin.local -q "addprinc -pw ${PROLE_KDC_GUEST_PASSWORD:-changeme} guest@${realm}" + kadmin.local -q "addprinc -pw ${KNOE_KDC_GUEST_PASSWORD:-changeme} guest@${realm}" fi - echo "Starting krb5kdc and kadmind ..." krb5kdc -n & sleep 0.5 if ! pgrep -x krb5kdc >/dev/null 2>&1; then - echo "ERROR: krb5kdc failed to start. Check /var/log/ (syslog) for details." >&2 + echo "ERROR: krb5kdc failed to start." >&2 exit 1 fi exec kadmind -nofork diff --git a/deploy/opentofu/k3s/manifests/knoe/prole-kdc-secrets.example.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-kdc-secrets.example.yaml similarity index 100% rename from deploy/opentofu/k3s/manifests/knoe/prole-kdc-secrets.example.yaml rename to deploy/opentofu/k3s/manifests/knoe/knoe-kdc-secrets.example.yaml diff --git a/deploy/opentofu/k3s/manifests/knoe/prole-service.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-service.yaml similarity index 100% rename from deploy/opentofu/k3s/manifests/knoe/prole-service.yaml rename to deploy/opentofu/k3s/manifests/knoe/knoe-service.yaml