apiVersion: v1
kind: ConfigMap
metadata:
  name: kerberos-config
data:
  krb5-redhat.conf: |
    [realms]
    REDHAT.COM = {
     default_domain = redhat.com
     dns_lookup_kdc = true
     master_kdc = kerberos.corp.redhat.com
     admin_server = kerberos.corp.redhat.com
    }
    #make sure to save the IPA CA cert
    #mkdir /etc/ipa && curl -o /etc/ipa/ca.crt https://password.corp.redhat.com/ipa.crt
    IPA.REDHAT.COM = {
     pkinit_anchors = FILE:/etc/ipa/ca.crt
     pkinit_pool = FILE:/etc/ipa/ca.crt
     default_domain = ipa.redhat.com
     dns_lookup_kdc = true
     # Trust tickets issued by legacy realm on this host
     auth_to_local = RULE:[1:$1@$0](.*@REDHAT\.COM)s/@.*//
     auth_to_local = DEFAULT
    }

    # DO NOT ADD A [domain_realms] section
    # https://mojo.redhat.com/docs/DOC-1166841

    [libdefaults]
    # Workaround for running `kinit` in an unprivileged container
    # by storing krb5 credential cache into a file rather than kernel keyring.
    # See https://blog.tomecek.net/post/kerberos-in-a-container/
    default_ccache_name = FILE:/tmp/krb5cc_%{uid}
    rdns = false
    default_realm = IPA.REDHAT.COM
    dns_lookup_realm = true
    dns_lookup_kdc = true
    allow_weak_crypto = yes
    udp_preference_limit = 0
