mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
1417bc51f0
Java implementation of the knoe-auth identity backbone (Round 1):
authority/.../admin/ user admin REST endpoints (list, deactivate,
reset-totp, role management)
authority/.../enroll/ invite-OTP web enrollment flow — accepts invite
token, creates Kerberos principal via kadmin,
seeds TOTP secret, returns keytab
authority/.../provisioning/ contributor provisioning service — orchestrates
invite generation, principal lifecycle, role grants
authority/.../kerberos/
KadminClient.java typed wrapper around the kadmin(1) subprocess;
create/delete/get-keytab/change-password
GKE manifests:
deploy/gcp/gke/knoe-auth-deployment.yaml two-container Pod (knoe-auth HTTP
+ kdc sidecar) with keytab-bootstrap
initContainer
deploy/gcp/gke/knoe-kdc-configmap.yaml krb5.conf, kdc.conf, kadm5.acl and
entrypoint for the embedded KDC
deploy/gcp/gke/knoe-kdc-secrets.yaml placeholder template — real values
created by init_knoe_auth.sh via 1Password
See docs/plans/knoe-auth-round-1.md for full architectural narrative.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
29 lines
954 B
YAML
29 lines
954 B
YAML
---
|
|
# knoe-kdc-secrets.yaml
|
|
# Placeholder / example structure. Real values are created by init_knoe_auth.sh
|
|
# using 1Password (op) and applied directly — this file is NOT committed with
|
|
# real secrets.
|
|
#
|
|
# To create manually:
|
|
# kubectl -n knoe-system create secret generic knoe-kdc-secrets \
|
|
# --from-literal=master_password="$(op item get 'knoe-kdc-master' --fields password)" \
|
|
# --from-literal=admin_password="$(op item get 'knoe-kdc-admin' --fields password)"
|
|
#
|
|
# Fields:
|
|
# master_password — KDC database master key (kdb5_util -P)
|
|
# admin_password — admin/admin@KNOE.DEV principal password (kadmin)
|
|
#
|
|
# Secret is referenced by:
|
|
# - knoe-kdc (KDC sidecar container)
|
|
# - keytab-bootstrap (initContainer)
|
|
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: knoe-kdc-secrets
|
|
namespace: knoe-system
|
|
type: Opaque
|
|
stringData:
|
|
master_password: "REPLACE_WITH_STRONG_RANDOM_VALUE"
|
|
admin_password: "REPLACE_WITH_STRONG_RANDOM_VALUE"
|