mirror of https://github.com/dredx/prole.git synced 2026-09-27 00:54:31 +00:00

History

chrisfu 872d715864 feat: Kerberos identity management — PROLE.LOCAL realm, cross-realm trust, user provisioning Kerberos is now the single source of truth for all knoe-system accounts. In-cluster KDC (PROLE.LOCAL): - Rename in-cluster KDC realm PROLE.ORG → PROLE.LOCAL to avoid collision with the myrddin.prole.org Samba AD DC which owns PROLE.ORG - Add [capaths] cross-realm trust block: PROLE.ORG (Samba AD) ↔ PROLE.LOCAL - Create admin@PROLE.LOCAL on KDC startup (master password) for UI login - Create guest@PROLE.LOCAL on KDC startup (read-only, PROLE_KDC_GUEST_PASSWORD) - Update prole-kdc-secrets.example.yaml with trust_shared_password and guest_password - Update prole-auth-kerberos ConfigMap realm/servicePrincipal to PROLE.LOCAL - Add PROLE_AUTH_ADMIN_PRINCIPALS and PROLE_KDC_GUEST_PASSWORD to prole-auth Deployment Database (knoe-db — k3s and GKE): - Add spec.managed.roles: admin (superuser), guest (login), developer (group) - Enable GSS pg_hba rules for both PROLE.ORG and PROLE.LOCAL realms - Add krb_server_keyfile parameter for postgres service principal keytab - Mount knoe-db-pg-keytab Secret via spec.additionalVolumes - Add demo schema in postInitSQL with guest read-only grants prole-auth (Spring Boot): - SessionUser: add List<String> groups field - AuthProperties: add adminPrincipals list (env: PROLE_AUTH_ADMIN_PRINCIPALS) - LoginController: stamp groups=["admin"] for configured admin principals at login - SessionTokenService: carry groups through TokenPayload; @JsonIgnoreProperties for backward compat with existing 2-field session cookies - VerifyController: emit X-Prole-Groups header on /auth/verify - grafana-proxy nginx: strip inbound X-Prole-Groups; capture and forward from auth Services: - ArgoCD (k3s + GKE): add g, admin, role:admin to argocd-rbac-cm policy.csv etc/init_knoe_users.sh (new): - Orchestrates full user provisioning: KDC principals, postgres keytab export, CNPG managed.roles patch, demo schema SQL, ArgoCD RBAC patch, Gitea and GitLab admin promotion via API - Actions: initialize \| status \| cleanup - Idempotent; sources prole_cfg.sh; follows existing init_*.sh style Cross-realm trust activation (myrddin side): samba-tool user add krbtgt_PROLELOCAL --random-password samba-tool user setpassword krbtgt_PROLELOCAL --newpassword=<trust_shared_password> samba-tool spn add "krbtgt/PROLE.LOCAL" krbtgt_PROLELOCAL -U administrator samba-tool user setexpiry krbtgt_PROLELOCAL --noexpiry Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>		2026-04-01 20:38:57 -07:00
..
argocd	feat: service layer — GitLab, Redis, DB ArgoCD app, Kong, monitoring updates	2026-04-01 20:38:57 -07:00
manifests	feat: Kerberos identity management — PROLE.LOCAL realm, cross-realm trust, user provisioning	2026-04-01 20:38:57 -07:00
main.tf	feat: Add GitOps (Gitea) and Supabase integration, plus database options	2026-02-26 18:32:15 -08:00
opentofu.auto.tfvars	Fix installer path portability (avoid hardcoded /Users paths)	2026-03-09 16:55:49 -07:00
README.md	feat: infrastructure and installer updates for k3s, OpenTofu, and prole-db	2026-02-05 21:27:18 -08:00
terraform.tfstate	Add `prole.spec` and extend OpenTofu k3s configuration	2026-02-24 21:47:02 -08:00
variables.tf	Add `prole.spec` and extend OpenTofu k3s configuration	2026-02-24 21:47:02 -08:00

README.md

OpenTofu k3s Pipeline

This pipeline re-deploys the Prole environment into a k3s cluster using OpenTofu.

Usage

Ensure opentofu.auto.tfvars is populated (install.py will generate it).
Sync manifests into deploy/opentofu/k3s/manifests.
Run:

tofu init
tofu plan
tofu apply

Files

main.tf: Applies Kubernetes manifests with the configured namespace.
variables.tf: Pipeline inputs (server URL, token, namespace).
opentofu.auto.tfvars: Auto-generated values from Prole install/config.
manifests/: Copy of k8s/ manifests to re-deploy.