chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 15:04:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
872d715864
prole/deploy/gcp/gke
History
chrisfu 872d715864 feat: Kerberos identity management — PROLE.LOCAL realm, cross-realm trust, user provisioning 
Kerberos is now the single source of truth for all knoe-system accounts.

In-cluster KDC (PROLE.LOCAL):
- Rename in-cluster KDC realm PROLE.ORG → PROLE.LOCAL to avoid collision
  with the myrddin.prole.org Samba AD DC which owns PROLE.ORG
- Add [capaths] cross-realm trust block: PROLE.ORG (Samba AD) ↔ PROLE.LOCAL
- Create admin@PROLE.LOCAL on KDC startup (master password) for UI login
- Create guest@PROLE.LOCAL on KDC startup (read-only, PROLE_KDC_GUEST_PASSWORD)
- Update prole-kdc-secrets.example.yaml with trust_shared_password and guest_password
- Update prole-auth-kerberos ConfigMap realm/servicePrincipal to PROLE.LOCAL
- Add PROLE_AUTH_ADMIN_PRINCIPALS and PROLE_KDC_GUEST_PASSWORD to prole-auth Deployment

Database (knoe-db — k3s and GKE):
- Add spec.managed.roles: admin (superuser), guest (login), developer (group)
- Enable GSS pg_hba rules for both PROLE.ORG and PROLE.LOCAL realms
- Add krb_server_keyfile parameter for postgres service principal keytab
- Mount knoe-db-pg-keytab Secret via spec.additionalVolumes
- Add demo schema in postInitSQL with guest read-only grants

prole-auth (Spring Boot):
- SessionUser: add List<String> groups field
- AuthProperties: add adminPrincipals list (env: PROLE_AUTH_ADMIN_PRINCIPALS)
- LoginController: stamp groups=["admin"] for configured admin principals at login
- SessionTokenService: carry groups through TokenPayload; @JsonIgnoreProperties
  for backward compat with existing 2-field session cookies
- VerifyController: emit X-Prole-Groups header on /auth/verify
- grafana-proxy nginx: strip inbound X-Prole-Groups; capture and forward from auth

Services:
- ArgoCD (k3s + GKE): add g, admin, role:admin to argocd-rbac-cm policy.csv

etc/init_knoe_users.sh (new):
- Orchestrates full user provisioning: KDC principals, postgres keytab export,
  CNPG managed.roles patch, demo schema SQL, ArgoCD RBAC patch,
  Gitea and GitLab admin promotion via API
- Actions: initialize | status | cleanup
- Idempotent; sources prole_cfg.sh; follows existing init_*.sh style

Cross-realm trust activation (myrddin side):
  samba-tool user add krbtgt_PROLELOCAL --random-password
  samba-tool user setpassword krbtgt_PROLELOCAL --newpassword=<trust_shared_password>
  samba-tool spn add "krbtgt/PROLE.LOCAL" krbtgt_PROLELOCAL -U administrator
  samba-tool user setexpiry krbtgt_PROLELOCAL --noexpiry

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-04-01 20:38:57 -07:00
..
argocd-oidc-cm.yaml feat: Kerberos identity management — PROLE.LOCAL realm, cross-realm trust, user provisioning 2026-04-01 20:38:57 -07:00
gitlab-google-oidc-secret.example.yaml feat: GKE production deployment — CNPG + GCS backups + Google Workspace SSO 2026-04-01 10:41:55 -07:00
knoe-auth-google-oidc-secret.example.yaml feat: GKE production deployment — CNPG + GCS backups + Google Workspace SSO 2026-04-01 10:41:55 -07:00
knoe-db-backup-gcs.yaml feat: GKE production deployment — CNPG + GCS backups + Google Workspace SSO 2026-04-01 10:41:55 -07:00
knoe-db.yaml feat: Kerberos identity management — PROLE.LOCAL realm, cross-realm trust, user provisioning 2026-04-01 20:38:57 -07:00
namespace.yaml feat: GKE production deployment — CNPG + GCS backups + Google Workspace SSO 2026-04-01 10:41:55 -07:00
workload-identity.yaml feat: GKE production deployment — CNPG + GCS backups + Google Workspace SSO 2026-04-01 10:41:55 -07:00