mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 14:54:34 +00:00
5cfd24cd05
KDC Service is 'auth' (ports 88/749); 'knoe-auth' only exposes HTTP port 8080. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
129 lines
3.3 KiB
YAML
129 lines
3.3 KiB
YAML
# gitea-spnego-proxy.yaml
|
|
# Apache + mod_auth_gssapi sidecar that handles SPNEGO/Kerberos negotiation for
|
|
# git.prole.org. Sits between Kong and Gitea; injects X-WEBAUTH-USER for reverse
|
|
# proxy auto-login. Gitea remains on port 3000 (cluster-internal); this proxy
|
|
# listens on port 4000 and is the Kong upstream target.
|
|
#
|
|
# Identity chain:
|
|
# Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000
|
|
# → GSSAPI (HTTP/git.prole.org@PROLE.ORG keytab)
|
|
# → X-WEBAUTH-USER: <username>
|
|
# → gitea-http.gitea:3000
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: gitea-krb5-conf
|
|
namespace: gitea
|
|
data:
|
|
krb5.conf: |
|
|
[libdefaults]
|
|
default_realm = PROLE.ORG
|
|
dns_lookup_realm = false
|
|
dns_lookup_kdc = false
|
|
forwardable = true
|
|
renewable = true
|
|
rdns = false
|
|
|
|
[realms]
|
|
PROLE.ORG = {
|
|
kdc = prole-kerberos-ad-dc.knoe-system.svc.cluster.local:88
|
|
admin_server = prole-kerberos-ad-dc.knoe-system.svc.cluster.local:88
|
|
}
|
|
KNOE.LOCAL = {
|
|
kdc = auth.knoe-system.svc.cluster.local:88
|
|
admin_server = auth.knoe-system.svc.cluster.local:749
|
|
}
|
|
|
|
[domain_realm]
|
|
.prole.org = PROLE.ORG
|
|
prole.org = PROLE.ORG
|
|
.prole.local = KNOE.LOCAL
|
|
prole.local = KNOE.LOCAL
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-spnego-proxy
|
|
namespace: gitea
|
|
labels:
|
|
app: gitea-spnego-proxy
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea-spnego-proxy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea-spnego-proxy
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: gandalf.prole.org
|
|
containers:
|
|
- name: proxy
|
|
image: myrddin.prole.org:5000/gitea-spnego-proxy:latest
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- name: http
|
|
containerPort: 4000
|
|
protocol: TCP
|
|
env:
|
|
- name: KRB5_CONFIG
|
|
value: /etc/krb5.conf
|
|
- name: KRB5_KTNAME
|
|
value: /etc/krb5/http.keytab
|
|
volumeMounts:
|
|
- name: keytab
|
|
mountPath: /etc/krb5
|
|
readOnly: true
|
|
- name: krb5-conf
|
|
mountPath: /etc/krb5.conf
|
|
subPath: krb5.conf
|
|
readOnly: true
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /_healthz
|
|
port: 4000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /_healthz
|
|
port: 4000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 64Mi
|
|
volumes:
|
|
- name: keytab
|
|
secret:
|
|
secretName: gitea-krb5-keytab
|
|
defaultMode: 0400
|
|
- name: krb5-conf
|
|
configMap:
|
|
name: gitea-krb5-conf
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-spnego-proxy
|
|
namespace: gitea
|
|
labels:
|
|
app: gitea-spnego-proxy
|
|
spec:
|
|
selector:
|
|
app: gitea-spnego-proxy
|
|
ports:
|
|
- name: http
|
|
port: 4000
|
|
targetPort: 4000
|
|
protocol: TCP
|
|
type: ClusterIP
|