prole/deploy/opentofu/k3s/manifests/knoe/prole-auth-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: knoe-auth
  labels:
    app: knoe-auth
spec:
  replicas: 1
  selector:
    matchLabels:
      app: knoe-auth
  template:
    metadata:
      labels:
        app: knoe-auth
    spec:
      initContainers:
        - name: keytab-bootstrap
          image: myrddin.prole.org:5000/knoe-authority:latest
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -lc
            - |
              set -euo pipefail
              export DEBIAN_FRONTEND=noninteractive

              realm="${PROLE_KDC_REALM:-PROLE.ORG}"
              admin_principal="${PROLE_KDC_ADMIN_PRINCIPAL:-admin/admin}"
              if [[ "${admin_principal}" != *"@"* ]]; then
                admin_principal="${admin_principal}@${realm}"
              fi

              svc_principal="${PROLE_KERBEROS_SERVICE_PRINCIPAL:?Missing PROLE_KERBEROS_SERVICE_PRINCIPAL}"
              if [[ "${svc_principal}" != *"@"* ]]; then
                svc_principal="${svc_principal}@${realm}"
              fi

              keytab_out="/etc/knoe/keytabs/http.keytab"
              mkdir -p "$(dirname "${keytab_out}")"

              if [[ -f /mnt/keytab-secret/http.keytab ]]; then
                cp /mnt/keytab-secret/http.keytab "${keytab_out}"
                chmod 0400 "${keytab_out}" || true
                exit 0
              fi

              if ! command -v kadmin.local >/dev/null 2>&1; then
                echo "Installing Kerberos packages..."
                echo "krb5-config krb5-config/default_realm string ${realm}" | debconf-set-selections || true
                echo "krb5-config krb5-config/kerberos_servers string 127.0.0.1" | debconf-set-selections || true
                echo "krb5-config krb5-config/admin_server string 127.0.0.1" | debconf-set-selections || true
                apt-get update
                apt-get install -y --no-install-recommends krb5-kdc krb5-admin-server krb5-user dnsutils ca-certificates
                rm -rf /var/lib/apt/lists/*
              fi

              mkdir -p /etc/krb5kdc /var/lib/krb5kdc
              if [[ -f /opt/knoe-kdc/krb5.conf ]]; then
                cp /opt/knoe-kdc/krb5.conf /etc/krb5.conf
              fi
              if [[ -f /opt/knoe-kdc/kdc.conf ]]; then
                cp /opt/knoe-kdc/kdc.conf /etc/krb5kdc/kdc.conf
              fi
              if [[ -f /opt/knoe-kdc/kadm5.acl ]]; then
                cp /opt/knoe-kdc/kadm5.acl /etc/krb5kdc/kadm5.acl
              fi

              if [[ -z "${PROLE_KDC_MASTER_PASSWORD:-}" ]]; then
                echo "ERROR: Missing required env PROLE_KDC_MASTER_PASSWORD (secret 'knoe-kdc-secrets/master_password')." >&2
                exit 1
              fi
              if [[ -z "${PROLE_KDC_ADMIN_PASSWORD:-}" ]]; then
                echo "ERROR: Missing required env PROLE_KDC_ADMIN_PASSWORD (secret 'knoe-kdc-secrets/admin_password')." >&2
                exit 1
              fi

              if [[ ! -f /var/lib/krb5kdc/principal ]]; then
                echo "Initializing realm database for ${realm}..."
                kdb5_util create -s -r "${realm}" -P "${PROLE_KDC_MASTER_PASSWORD}"
              fi

              if ! kadmin.local -q "get_principal ${admin_principal}" >/dev/null 2>&1; then
                echo "Creating admin principal ${admin_principal}..."
                kadmin.local -q "addprinc -pw ${PROLE_KDC_ADMIN_PASSWORD} ${admin_principal}"
              fi

              if ! kadmin.local -q "get_principal ${svc_principal}" >/dev/null 2>&1; then
                echo "Creating service principal ${svc_principal}..."
                kadmin.local -q "addprinc -randkey ${svc_principal}"
              fi

              kadmin.local -q "ktadd -k ${keytab_out} -norandkey ${svc_principal}"
              chmod 0400 "${keytab_out}" || true              
          env:
            - name: PROLE_KDC_REALM
              valueFrom:
                configMapKeyRef:
                  name: knoe-auth-kerberos
                  key: realm
            - name: PROLE_KDC_ADMIN_PRINCIPAL
              value: "admin/admin"
            - name: PROLE_KDC_MASTER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: knoe-kdc-secrets
                  key: master_password
            - name: PROLE_KDC_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: knoe-kdc-secrets
                  key: admin_password
            - name: PROLE_KERBEROS_SERVICE_PRINCIPAL
              valueFrom:
                configMapKeyRef:
                  name: knoe-auth-kerberos
                  key: servicePrincipal
          volumeMounts:
            - name: keytab
              mountPath: /etc/knoe/keytabs
            - name: keytab-secret
              mountPath: /mnt/keytab-secret
              readOnly: true
            - name: knoe-kdc-config
              mountPath: /opt/knoe-kdc
            - name: knoe-kdc-data
              mountPath: /var/lib/krb5kdc
            - name: knoe-kdc-data
              mountPath: /etc/krb5kdc
      containers:
        - name: knoe-auth
          image: knoe-auth:latest
          ports:
            - containerPort: 8080
              name: http
          env:
            - name: PROLE_AUTH_ENABLED
              value: "true"
            - name: PROLE_AUTH_COOKIE_DOMAIN
              valueFrom:
                configMapKeyRef:
                  name: knoe-platform-config
                  key: authCookieDomain
                  optional: true
            - name: PROLE_AUTH_SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: knoe-auth-secrets
                  key: sessionSecret
            - name: PROLE_KERBEROS_SERVICE_PRINCIPAL
              valueFrom:
                configMapKeyRef:
                  name: knoe-auth-kerberos
                  key: servicePrincipal
            - name: PROLE_KERBEROS_KEYTAB_PATH
              value: "/etc/knoe/keytabs/http.keytab"
            - name: PROLE_KERBEROS_REALM
              valueFrom:
                configMapKeyRef:
                  name: knoe-auth-kerberos
                  key: realm
            # ── Google Workspace OIDC (primary auth for GKE/prod) ──────────
            # Secret created by installer from Auth+Routing tab OIDC fields.
            # Template: deploy/gcp/gke/knoe-auth-google-oidc-secret.example.yaml
            - name: GOOGLE_OIDC_ENABLED
              value: "true"
            - name: GOOGLE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: knoe-auth-google-oidc
                  key: client_id
                  optional: true   # Kerberos-only deployments can omit this secret
            - name: GOOGLE_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: knoe-auth-google-oidc
                  key: client_secret
                  optional: true
            - name: GOOGLE_HOSTED_DOMAIN
              valueFrom:
                secretKeyRef:
                  name: knoe-auth-google-oidc
                  key: hosted_domain
                  optional: true   # blank = any Google account; set to restrict to Workspace domain
            - name: OIDC_ISSUER_URL
              value: "https://knoe-auth.knoe-system.svc.cluster.local:8080"
            - name: OIDC_BASE_URL
              valueFrom:
                configMapKeyRef:
                  name: knoe-platform-config
                  key: frontdoorHost
                  optional: true
            # Comma-separated list of bare usernames granted admin group in OIDC tokens
            - name: PROLE_AUTH_ADMIN_PRINCIPALS
              value: "admin"
          volumeMounts:
            - name: keytab
              mountPath: /etc/knoe/keytabs
              readOnly: true
            - name: knoe-kdc-config
              mountPath: /etc/krb5.conf
              subPath: krb5.conf
              readOnly: true
        - name: kdc
          image: myrddin.prole.org:5000/knoe-authority:latest
          imagePullPolicy: IfNotPresent
          command: ["/bin/bash", "/opt/knoe-kdc/entrypoint.sh"]
          env:
            - name: PROLE_KDC_REALM
              valueFrom:
                configMapKeyRef:
                  name: knoe-auth-kerberos
                  key: realm
            - name: PROLE_KDC_ADMIN_PRINCIPAL
              value: "admin/admin"
            - name: PROLE_KDC_MASTER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: knoe-kdc-secrets
                  key: master_password
            - name: PROLE_KDC_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: knoe-kdc-secrets
                  key: admin_password
            - name: PROLE_KDC_GUEST_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: knoe-kdc-secrets
                  key: guest_password
                  optional: true   # auto-generated by init_knoe_users.sh if absent
          ports:
            - name: krb5-udp
              containerPort: 88
              protocol: UDP
            - name: krb5-tcp
              containerPort: 88
              protocol: TCP
            - name: kpasswd-udp
              containerPort: 464
              protocol: UDP
            - name: kpasswd-tcp
              containerPort: 464
              protocol: TCP
            - name: kadmin
              containerPort: 749
              protocol: TCP
          volumeMounts:
            - name: knoe-kdc-config
              mountPath: /opt/knoe-kdc
            - name: knoe-kdc-data
              mountPath: /var/lib/krb5kdc
            - name: knoe-kdc-data
              mountPath: /etc/krb5kdc
      volumes:
        - name: keytab
          emptyDir: {}
        - name: keytab-secret
          secret:
            secretName: knoe-auth-keytab
            optional: true
        - name: knoe-kdc-config
          configMap:
            name: knoe-kdc-config
            defaultMode: 0755
        - name: knoe-kdc-data
          emptyDir: {}