# prole-kerberos-ad-dc-svc.yaml
# ExternalName Service so that in-cluster pods (gitea-spnego-proxy krb5.conf,
# knoe-auth cross-realm trust) can resolve the PROLE.ORG Samba AD KDC by a
# stable in-cluster DNS name rather than a bare IP.
#
# The PROLE.ORG realm KDC is myrddin.prole.org (10.0.0.3, Tailscale-routed).
# Referenced in gitea-spnego-proxy.yaml ConfigMap as:
#   kdc = prole-kerberos-ad-dc.knoe-system.svc.cluster.local:88
apiVersion: v1
kind: Service
metadata:
  name: prole-kerberos-ad-dc
  namespace: knoe-system
  labels:
    app: prole-kerberos-ad-dc
spec:
  type: ExternalName
  externalName: myrddin.prole.org
  ports:
    - name: kerberos-tcp
      port: 88
      protocol: TCP
    - name: kerberos-udp
      port: 88
      protocol: UDP
    - name: kadmin
      port: 749
      protocol: TCP