# Example: Kubernetes Secret for the HTTP SPNEGO keytab.
#
# DO NOT apply this file directly — it is documentation only.
#
# The keytab must contain the service principal HTTP/api.prole.org@PROLE.ORG.
#
# How to generate and deploy the keytab:
#   On the KDC (myrddin.prole.org or the knoe-kdc pod):
#     kadmin.local -q "addprinc -randkey HTTP/api.prole.org@PROLE.ORG"
#     kadmin.local -q "ktadd -k /tmp/http.keytab HTTP/api.prole.org@PROLE.ORG"
#
#   Then create the secret:
#     kubectl create secret generic knoe-auth-http-keytab \
#       --namespace knoe-system \
#       --from-file=http.keytab=/tmp/http.keytab
#
#   Verify (should show the HTTP/api.prole.org principal):
#     kubectl exec -n knoe-system deploy/knoe-auth -c knoe-auth -- \
#       klist -k /etc/knoe-auth/http.keytab
#
# The deployment mounts this secret at /etc/knoe-auth/http.keytab.
# The Spring Boot app reads KNOE_KERBEROS_KEYTAB_PATH=/etc/knoe-auth/http.keytab.
#
# This example file shows the structure but contains a placeholder value.
apiVersion: v1
kind: Secret
metadata:
  name: knoe-auth-http-keytab
  namespace: knoe-system
  labels:
    app.kubernetes.io/part-of: knoe-auth
type: Opaque
data:
  # base64-encoded content of the http.keytab file.
  # Replace with: base64 -w0 /path/to/http.keytab
  http.keytab: REPLACE_WITH_BASE64_ENCODED_KEYTAB