mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
872d715864
Kerberos is now the single source of truth for all knoe-system accounts. In-cluster KDC (PROLE.LOCAL): - Rename in-cluster KDC realm PROLE.ORG → PROLE.LOCAL to avoid collision with the myrddin.prole.org Samba AD DC which owns PROLE.ORG - Add [capaths] cross-realm trust block: PROLE.ORG (Samba AD) ↔ PROLE.LOCAL - Create admin@PROLE.LOCAL on KDC startup (master password) for UI login - Create guest@PROLE.LOCAL on KDC startup (read-only, PROLE_KDC_GUEST_PASSWORD) - Update prole-kdc-secrets.example.yaml with trust_shared_password and guest_password - Update prole-auth-kerberos ConfigMap realm/servicePrincipal to PROLE.LOCAL - Add PROLE_AUTH_ADMIN_PRINCIPALS and PROLE_KDC_GUEST_PASSWORD to prole-auth Deployment Database (knoe-db — k3s and GKE): - Add spec.managed.roles: admin (superuser), guest (login), developer (group) - Enable GSS pg_hba rules for both PROLE.ORG and PROLE.LOCAL realms - Add krb_server_keyfile parameter for postgres service principal keytab - Mount knoe-db-pg-keytab Secret via spec.additionalVolumes - Add demo schema in postInitSQL with guest read-only grants prole-auth (Spring Boot): - SessionUser: add List<String> groups field - AuthProperties: add adminPrincipals list (env: PROLE_AUTH_ADMIN_PRINCIPALS) - LoginController: stamp groups=["admin"] for configured admin principals at login - SessionTokenService: carry groups through TokenPayload; @JsonIgnoreProperties for backward compat with existing 2-field session cookies - VerifyController: emit X-Prole-Groups header on /auth/verify - grafana-proxy nginx: strip inbound X-Prole-Groups; capture and forward from auth Services: - ArgoCD (k3s + GKE): add g, admin, role:admin to argocd-rbac-cm policy.csv etc/init_knoe_users.sh (new): - Orchestrates full user provisioning: KDC principals, postgres keytab export, CNPG managed.roles patch, demo schema SQL, ArgoCD RBAC patch, Gitea and GitLab admin promotion via API - Actions: initialize | status | cleanup - Idempotent; sources prole_cfg.sh; follows existing init_*.sh style Cross-realm trust activation (myrddin side): samba-tool user add krbtgt_PROLELOCAL --random-password samba-tool user setpassword krbtgt_PROLELOCAL --newpassword=<trust_shared_password> samba-tool spn add "krbtgt/PROLE.LOCAL" krbtgt_PROLELOCAL -U administrator samba-tool user setexpiry krbtgt_PROLELOCAL --noexpiry Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
60 lines
1.5 KiB
YAML
60 lines
1.5 KiB
YAML
---
|
|
# Patch argocd-cm to enable Google Workspace SSO via knoe-auth OIDC issuer.
|
|
# Applied by etc/init_argocd.sh --mode k8s after ArgoCD is installed.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-cm
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/name: argocd-cm
|
|
app.kubernetes.io/part-of: argocd
|
|
data:
|
|
# Set url to your ArgoCD external hostname
|
|
url: "https://argocd.${PLATFORM_DOMAIN}"
|
|
oidc.config: |
|
|
name: "Google Workspace"
|
|
issuer: "https://${FRONTDOOR_HOST}/auth"
|
|
clientID: argocd
|
|
clientSecret: $oidc.argocd.clientSecret
|
|
requestedScopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
requestedIDTokenClaims:
|
|
groups:
|
|
essential: true
|
|
|
|
---
|
|
# RBAC: map Google Workspace admin email to ArgoCD admin role.
|
|
# Add additional group/email → role mappings under policy.csv.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-rbac-cm
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/name: argocd-rbac-cm
|
|
app.kubernetes.io/part-of: argocd
|
|
data:
|
|
policy.default: role:readonly
|
|
policy.csv: |
|
|
g, ${BOOTSTRAP_ADMIN_EMAIL}, role:admin
|
|
g, admin, role:admin
|
|
|
|
---
|
|
# Secret referenced by oidc.config above ($oidc.argocd.clientSecret).
|
|
# Populated by the installer from the OIDC Client Secret field.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: argocd-secret
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/name: argocd-secret
|
|
app.kubernetes.io/part-of: argocd
|
|
type: Opaque
|
|
stringData:
|
|
oidc.argocd.clientSecret: "" # set by installer
|