mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
bb71cf68ea
knoe-auth (Spring Boot OIDC provider): - AuthProperties: add google.workspaceDomain and kerberos.servicePrincipal fields - GoogleOAuthService: validate hd (hosted domain) claim; restrict to configured workspace - LoginController: /login/google endpoint + SPNEGO negotiation entry point - PrincipalNormalizer: map Kerberos principal (user@REALM) to knoe-auth user - application.yml: add spring.security.kerberos and oauth2.client stubs (values injected at runtime from env / Kubernetes Secrets) - knoe-auth-deployment.yaml: mount HTTP keytab Secret; add GOOGLE_PROLE_CLIENT_ID / GOOGLE_PROLE_CLIENT_SECRET env from oauth2-proxy-prole-secret - knoe-auth-http-keytab-secret.example.yaml: example Secret for HTTP/<host> keytab Kong (init_kong.sh): - Add db.prole.org route in k3s mode block via oauth2-proxy upstream - Mode-gate: only registered for k3s, excluded for k3d/k8s Supabase / oauth2-proxy: - New supabase/helm/oauth2-proxy Helm chart: gates Supabase Studio at db.prole.org with Google OAuth (email-domain=prole.org) + cookie settings for .prole.org domain - values-k3s.yaml: k3s-specific overrides (upstream service, TLS, cookie domain) - secret-example.yaml: placeholder for oauth2-proxy-prole-secret Ansible: - infrastructure/playbooks/kerberos_trust_setup.yml: automates samba-tool domain trust create on myrddin.prole.org for PROLE.LOCAL ↔ PROLE.ORG cross-realm trust Test: - GoogleLoginProleOrgTest: verifies hd=prole.org tokens are accepted; hd=other.com rejected Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
# Example: Kubernetes Secret for the HTTP SPNEGO keytab.
|
|
#
|
|
# DO NOT apply this file directly — it is documentation only.
|
|
#
|
|
# The keytab must contain the service principal HTTP/api.prole.org@PROLE.ORG.
|
|
#
|
|
# How to generate and deploy the keytab:
|
|
# On the KDC (myrddin.prole.org or the knoe-kdc pod):
|
|
# kadmin.local -q "addprinc -randkey HTTP/api.prole.org@PROLE.ORG"
|
|
# kadmin.local -q "ktadd -k /tmp/http.keytab HTTP/api.prole.org@PROLE.ORG"
|
|
#
|
|
# Then create the secret:
|
|
# kubectl create secret generic knoe-auth-http-keytab \
|
|
# --namespace knoe-system \
|
|
# --from-file=http.keytab=/tmp/http.keytab
|
|
#
|
|
# Verify (should show the HTTP/api.prole.org principal):
|
|
# kubectl exec -n knoe-system deploy/knoe-auth -c knoe-auth -- \
|
|
# klist -k /etc/knoe-auth/http.keytab
|
|
#
|
|
# The deployment mounts this secret at /etc/knoe-auth/http.keytab.
|
|
# The Spring Boot app reads KNOE_KERBEROS_KEYTAB_PATH=/etc/knoe-auth/http.keytab.
|
|
#
|
|
# This example file shows the structure but contains a placeholder value.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: knoe-auth-http-keytab
|
|
namespace: knoe-system
|
|
labels:
|
|
app.kubernetes.io/part-of: knoe-auth
|
|
type: Opaque
|
|
data:
|
|
# base64-encoded content of the http.keytab file.
|
|
# Replace with: base64 -w0 /path/to/http.keytab
|
|
http.keytab: REPLACE_WITH_BASE64_ENCODED_KEYTAB
|