From e6392cbbfe9d6c1028606117b3dd905a2cb50aeb Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Tue, 3 Nov 2026 17:09:50 +0500
Subject: [PATCH] =?UTF-8?q?uralkal:=20camunda=20keycloak=20=E2=80=94=20key?=
 =?UTF-8?q?tab=20=D0=B8=D0=B7=20Secret=20keycloak-keytab=20=D0=B8=20krb5.c?=
 =?UTF-8?q?onf=20=D0=B4=D0=BB=D1=8F=20LOCAL.URALKALI.COM?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infrastructure/camunda/uralkal/camunda.yaml   | 16 ++++++++++++
 .../camunda/uralkal/keycloak-krb5.yaml        | 25 +++++++++++++++++++
 .../camunda/uralkal/kustomization.yaml        |  1 +
 3 files changed, 42 insertions(+)
 create mode 100644 infrastructure/camunda/uralkal/keycloak-krb5.yaml

diff --git a/infrastructure/camunda/uralkal/camunda.yaml b/infrastructure/camunda/uralkal/camunda.yaml
index 3dadb45..a821642 100644
--- a/infrastructure/camunda/uralkal/camunda.yaml
+++ b/infrastructure/camunda/uralkal/camunda.yaml
@@ -213,6 +213,22 @@ spec:
           size: 10Gi
           storageClass: local-path
     identityKeycloak:
+      extraVolumes:
+        - name: keytab
+          secret:
+            secretName: keycloak-keytab
+            optional: true
+        - name: krb5
+          configMap:
+            name: keycloak-krb5
+      extraVolumeMounts:
+        - name: keytab
+          mountPath: /opt/keytab
+          readOnly: true
+        - name: krb5
+          mountPath: /etc/krb5.conf
+          subPath: krb5.conf
+          readOnly: true
       externalDatabase:
         host: 10.133.0.249
         port: 5432
diff --git a/infrastructure/camunda/uralkal/keycloak-krb5.yaml b/infrastructure/camunda/uralkal/keycloak-krb5.yaml
new file mode 100644
index 0000000..912647e
--- /dev/null
+++ b/infrastructure/camunda/uralkal/keycloak-krb5.yaml
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: keycloak-krb5
+  namespace: camunda
+data:
+  krb5.conf: |
+    [libdefaults]
+      default_realm = LOCAL.URALKALI.COM
+      dns_lookup_kdc = false
+      dns_lookup_realm = false
+      rdns = false
+      default_tkt_enctypes = aes256-cts-hmac-sha1-96
+      default_tgs_enctypes = aes256-cts-hmac-sha1-96
+      permitted_enctypes = aes256-cts-hmac-sha1-96
+
+    [realms]
+      LOCAL.URALKALI.COM = {
+        kdc = PERM-GL-DC3.local.uralkali.com
+        admin_server = PERM-GL-DC3.local.uralkali.com
+      }
+
+    [domain_realm]
+      .local.uralkali.com = LOCAL.URALKALI.COM
+      local.uralkali.com = LOCAL.URALKALI.COM
diff --git a/infrastructure/camunda/uralkal/kustomization.yaml b/infrastructure/camunda/uralkal/kustomization.yaml
index 0c26313..6755742 100644
--- a/infrastructure/camunda/uralkal/kustomization.yaml
+++ b/infrastructure/camunda/uralkal/kustomization.yaml
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - keycloak-krb5.yaml
 patches:
   - path: camunda.yaml