mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
5cece408bd
The cross-realm trust playbook was written for the pre-rebrand realm name PROLE.LOCAL, which no longer exists in the in-cluster KDC — the canonical realm is now KNOE.LOCAL. The Samba AD trust was therefore never actually established, leaving chrisfu@KNOE.LOCAL→chrisfu@PROLE.ORG service ticket flows blocked (and blocking pg_oauth / db.prole.org Kerberos work). Changes: - Realm: PROLE.LOCAL → KNOE.LOCAL across all task names, vars, and the krb5.conf [realms] / [domain_realm] blocks added on myrddin. - samba_admin_password now resolves from the Ansible vault var vault_samba_dns_admin_pass (group_vars/ad_dc/vault.yml) by default, with SAMBA_ADMIN_PASSWORD env and -e overrides preserved for CI. - trust_shared_password auto-resolves from the in-cluster Secret knoe-system/knoe-kdc-secrets (key trust_shared_password) when not passed explicitly — same Secret init_kdc.sh writes. - Added [domain_realm] mapping for *.knoe.local → KNOE.LOCAL so Samba can resolve in-cluster service principals. - Added a final `samba-tool domain trust show` smoke step so a successful run prints the visible trust state for log review. Run: ANSIBLE_VAULT_PASSWORD_FILE=$PWD/.vault_pass ansible-playbook infrastructure/playbooks/kerberos_trust_setup.yml Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| deployments/svc-check-helm | ||
| inventory | ||
| playbooks | ||
| roles | ||
| setup | ||
| ansible.cfg | ||