mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
c9591a5da2
Complete, review-ready runbook to light up Kerberos/GSSAPI on db.prole.org so `kn db --service prole.org` authenticates with a local PROLE.ORG ticket — the airgap data lane (no password, no knoe-auth, no internet). Nothing applied. Delivers: - Samba SPN + keytab export steps (myrddin): postgres/db.prole.org@PROLE.ORG - k8s keytab secret (knoe-db-gss-keytab-secret.example.yaml template) - exact knoe-db.yaml diff: krb_server_keyfile, hostgssenc pg_hba (include_realm=0 → role), projectedVolumeTemplate keytab mount, chrisfu/ron managed roles - apply + end-to-end verify (kinit → kn db --service prole.org) - failure-mode triage, rollback, follow-ups Hooks into the manifest's existing placeholders (knoe-db.yaml lines 38 + 45, which already note 'Kerberos disabled on k3s'). Image is already --with-gssapi. Flags the PROLE.ORG (Kerberos) vs PROLE.LOCAL (knoe.user default) discrepancy to reconcile. Grants intentionally deferred — connect succeeds, reads gated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
# knoe-db-gss-keytab — Kerberos service keytab for db.prole.org GSSAPI auth.
|
|
#
|
|
# Holds the keytab for the Postgres service principal so libpq GSSAPI clients
|
|
# (e.g. `kn db --service prole.org`) can authenticate with a local PROLE.ORG
|
|
# ticket — no password, fully airgap-capable.
|
|
#
|
|
# DO NOT commit the real keytab. This is a template; create the live secret from
|
|
# the keytab exported on myrddin (see docs/runbooks/db-prole-gssapi.md):
|
|
#
|
|
# sudo samba-tool domain exportkeytab /tmp/pg.keytab \
|
|
# --principal=postgres/db.prole.org@PROLE.ORG
|
|
# kubectl --context=prole-service-cluster -n knoe create secret generic \
|
|
# knoe-db-gss-keytab --from-file=postgres.keytab=/tmp/pg.keytab
|
|
# rm -f /tmp/pg.keytab # shred the keytab off disk
|
|
#
|
|
# The CNPG cluster mounts this via spec.projectedVolumeTemplate at
|
|
# /projected/postgres.keytab and points krb_server_keyfile there.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: knoe-db-gss-keytab
|
|
namespace: knoe
|
|
type: Opaque
|
|
data:
|
|
# base64 of the binary keytab for postgres/db.prole.org@PROLE.ORG
|
|
postgres.keytab: <BASE64_KEYTAB_HERE>
|