mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
c9591a5da2
Complete, review-ready runbook to light up Kerberos/GSSAPI on db.prole.org so `kn db --service prole.org` authenticates with a local PROLE.ORG ticket — the airgap data lane (no password, no knoe-auth, no internet). Nothing applied. Delivers: - Samba SPN + keytab export steps (myrddin): postgres/db.prole.org@PROLE.ORG - k8s keytab secret (knoe-db-gss-keytab-secret.example.yaml template) - exact knoe-db.yaml diff: krb_server_keyfile, hostgssenc pg_hba (include_realm=0 → role), projectedVolumeTemplate keytab mount, chrisfu/ron managed roles - apply + end-to-end verify (kinit → kn db --service prole.org) - failure-mode triage, rollback, follow-ups Hooks into the manifest's existing placeholders (knoe-db.yaml lines 38 + 45, which already note 'Kerberos disabled on k3s'). Image is already --with-gssapi. Flags the PROLE.ORG (Kerberos) vs PROLE.LOCAL (knoe.user default) discrepancy to reconcile. Grants intentionally deferred — connect succeeds, reads gated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| k3s | ||
| k8s/manifests | ||
| prod | ||