# knoe-db-gss-keytab — Kerberos service keytab for db.prole.org GSSAPI auth.
#
# Holds the keytab for the Postgres service principal so libpq GSSAPI clients
# (e.g. `kn db --service prole.org`) can authenticate with a local PROLE.ORG
# ticket — no password, fully airgap-capable.
#
# DO NOT commit the real keytab. This is a template; create the live secret from
# the keytab exported on myrddin (see docs/runbooks/db-prole-gssapi.md):
#
#   sudo samba-tool domain exportkeytab /tmp/pg.keytab \
#       --principal=postgres/db.prole.org@PROLE.ORG
#   kubectl --context=prole-service-cluster -n knoe create secret generic \
#     knoe-db-gss-keytab --from-file=postgres.keytab=/tmp/pg.keytab
#   rm -f /tmp/pg.keytab        # shred the keytab off disk
#
# The CNPG cluster mounts this via spec.projectedVolumeTemplate at
# /projected/postgres.keytab and points krb_server_keyfile there.
apiVersion: v1
kind: Secret
metadata:
  name: knoe-db-gss-keytab
  namespace: knoe
type: Opaque
data:
  # base64 of the binary keytab for postgres/db.prole.org@PROLE.ORG
  postgres.keytab: <BASE64_KEYTAB_HERE>