From 2e38ec0461622dc03f1c5caf3880279e1c82a8c7 Mon Sep 17 00:00:00 2001
From: Jonathan Christison <jochrist@redhat.com>
Date: Tue, 13 Jun 2023 17:21:25 +0100
Subject: [PATCH] Add krb5.conf to container as config map

---
 k8s/kerberos-config.yaml                  | 43 +++++++++++++++++++++++
 src/main/resources/application.properties |  8 +++++
 2 files changed, 51 insertions(+)
 create mode 100644 k8s/kerberos-config.yaml

diff --git a/k8s/kerberos-config.yaml b/k8s/kerberos-config.yaml
new file mode 100644
index 0000000..e449e38
--- /dev/null
+++ b/k8s/kerberos-config.yaml
@@ -0,0 +1,43 @@
+#wget https://gitlab.corp.redhat.com/it-iam/system-configs/raw/master/krb5/idm/linux-krb5.conf && oc create configmap kerberos-config --from-file=linux-krb5.conf --dry-run=client -o yaml > kerberos-config.yaml
+apiVersion: v1
+data:
+  linux-krb5.conf: |
+    includedir /etc/krb5.conf.d/
+
+    # depending on your config, you may wish to uncomment the following:
+    # includedir /var/lib/sss/pubconf/krb5.include.d/
+
+    [libdefaults]
+      default_realm = IPA.REDHAT.COM
+      dns_lookup_realm = true
+      dns_lookup_kdc = true
+      rdns = false
+      dns_canonicalize_hostname = false
+      ticket_lifetime = 24h
+      forwardable = true
+      udp_preference_limit = 0
+      default_ccache_name = KEYRING:persistent:%{uid}
+
+    [realms]
+
+        REDHAT.COM = {
+            default_domain = redhat.com
+            dns_lookup_kdc = true
+            master_kdc = kerberos.corp.redhat.com
+            admin_server = kerberos.corp.redhat.com
+        }
+
+        IPA.REDHAT.COM = {
+           default_domain = ipa.redhat.com
+           dns_lookup_kdc = true
+           # Trust tickets issued by legacy realm on this host
+           auth_to_local = RULE:[1:$1@$0](.*@REDHAT\.COM)s/@.*//
+           auth_to_local = DEFAULT
+        }
+
+    #DO NOT ADD A [domain_realms] section
+    #https://mojo.redhat.com/docs/DOC-1166841
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: kerberos-config
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index bf159e3..4c3d438 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -22,4 +22,12 @@
 %stage.quarkus.kerberos.keytab-path= /kerberos/kerberos-keytab-osh
 %stage.quarkus.kerberos.service-principal-name= HTTP/osh-pct-security-tooling.apps.ocp-c1.prod.psi.redhat.com@IPA.REDHAT.COM
 
+%stage.quarkus.openshift.mounts.osh-wrapper-config-vol.path=/etc/krb5.conf
+%stage.quarkus.openshift.mounts.osh-wrapper-config-vol.sub-path=linux-krb5.conf
+%stage.quarkus.openshift.config-map-volumes.osh-wrapper-config-vol.config-map-name=kerberos-config
+%stage.quarkus.openshift.config-map-volumes.osh-wrapper-config-vol.items."linux-krb5.conf".path=linux-krb5.conf
+%stage.quarkus.openshift.mounts.osh-wrapper-config-vol.read-only=true
+
+
+%stage.quarkus.log.level=DEBUG