#wget https://gitlab.corp.redhat.com/it-iam/system-configs/raw/master/krb5/idm/linux-krb5.conf && oc create configmap kerberos-config --from-file=linux-krb5.conf --dry-run=client -o yaml > kerberos-config.yaml
apiVersion: v1
data:
  linux-krb5.conf: |
    includedir /etc/krb5.conf.d/

    # depending on your config, you may wish to uncomment the following:
    # includedir /var/lib/sss/pubconf/krb5.include.d/

    [libdefaults]
      default_realm = IPA.REDHAT.COM
      dns_lookup_realm = true
      dns_lookup_kdc = true
      rdns = false
      dns_canonicalize_hostname = false
      ticket_lifetime = 24h
      forwardable = true
      udp_preference_limit = 0
      default_ccache_name = KEYRING:persistent:%{uid}

    [realms]

        REDHAT.COM = {
            default_domain = redhat.com
            dns_lookup_kdc = true
            master_kdc = kerberos.corp.redhat.com
            admin_server = kerberos.corp.redhat.com
        }

        IPA.REDHAT.COM = {
           default_domain = ipa.redhat.com
           dns_lookup_kdc = true
           # Trust tickets issued by legacy realm on this host
           auth_to_local = RULE:[1:$1@$0](.*@REDHAT\.COM)s/@.*//
           auth_to_local = DEFAULT
        }

    #DO NOT ADD A [domain_realms] section
    #https://mojo.redhat.com/docs/DOC-1166841
kind: ConfigMap
metadata:
  creationTimestamp: null
  name: kerberos-config