uralkal: camunda keycloak — keytab из Secret keycloak-keytab и krb5.conf для LOCAL.URALKALI.COM

infrastructure/camunda/uralkal/camunda.yaml

@@ -213,6 +213,22 @@ spec:
           size: 10Gi
           storageClass: local-path
     identityKeycloak:
+      extraVolumes:
+        - name: keytab
+          secret:
+            secretName: keycloak-keytab
+            optional: true
+        - name: krb5
+          configMap:
+            name: keycloak-krb5
+      extraVolumeMounts:
+        - name: keytab
+          mountPath: /opt/keytab
+          readOnly: true
+        - name: krb5
+          mountPath: /etc/krb5.conf
+          subPath: krb5.conf
+          readOnly: true
       externalDatabase:
         host: 10.133.0.249
         port: 5432

infrastructure/camunda/uralkal/keycloak-krb5.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: keycloak-krb5
+  namespace: camunda
+data:
+  krb5.conf: |
+    [libdefaults]
+      default_realm = LOCAL.URALKALI.COM
+      dns_lookup_kdc = false
+      dns_lookup_realm = false
+      rdns = false
+      default_tkt_enctypes = aes256-cts-hmac-sha1-96
+      default_tgs_enctypes = aes256-cts-hmac-sha1-96
+      permitted_enctypes = aes256-cts-hmac-sha1-96
+
+    [realms]
+      LOCAL.URALKALI.COM = {
+        kdc = PERM-GL-DC3.local.uralkali.com
+        admin_server = PERM-GL-DC3.local.uralkali.com
+      }
+
+    [domain_realm]
+      .local.uralkali.com = LOCAL.URALKALI.COM
+      local.uralkali.com = LOCAL.URALKALI.COM

infrastructure/camunda/uralkal/kustomization.yaml

@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - keycloak-krb5.yaml
 patches:
   - path: camunda.yaml