apiVersion: v1
kind: ConfigMap
metadata:
  name: kerberos-configmap
data:
  krb5.conf: |-
    [logging]                                  
    default = FILE:/var/log/krb5libs.log      
    kdc = FILE:/var/log/krb5kdc.log           
    admin_server = FILE:/var/log/kadmind.log  

    [libdefaults]                              
    ticket_lifetime = 24000                   
    default_realm = KERBEROS            

    [realms]                                   
    KERBEROS = {                         
    kdc = kerberos:88           
    admin_server = kerberos:749 
    default_domain = kerberos           
    }                                         

    [domain_realm]                             
    .kerberos = KERBEROS            
    kerberos = KERBEROS            

    [kdc]                                      
    profile = /etc/kerberos/kdc.conf  

    [pam]
    debug = false
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false

  kdc.conf: |-
    [kdcdefaults]                                                                   
    kdc_ports = 88                                                                 
    acl_file = /etc/kerberos/kadm5.acl                                     
    dict_file = /usr/dict/words                                                    
    admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab                              

    [realms]                                                                        
    KERBEROS = {                                                              
      database_name = /var/kerberos/krb5kdc/principal                               
      admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab                             
      kadmind_port = 749                                                            
      acl_file = /etc/kerberos/kadm5.acl                                    
      dict_file = /usr/dict/words                                                   
    }

  kadm5.acl: |-
    */admin@KERBEROS *

  start.sh: |-
    #!/bin/sh

    # Create kerberos database
    expect -c "
    spawn kdb5_util create -s
    expect \"Enter KDC database master key:\"
    send \"admin\n\"
    expect \"Re-enter KDC database master key to verify:\"
    send \"admin\n\"
    expect eof
    exit
    "

    # Start services
    /usr/sbin/krb5kdc
    /usr/sbin/kadmind

    # Create principals and add them to keytab
    expect -c "
    spawn kadmin.local
    # Create principal host
    expect \"kadmin.local:\"
    send \"addprinc host/kerberos\n\"
    expect \"Enter password for principal 'host/kerberos@KERBEROS':\"
    send \"admin\n\"
    expect \"Re-enter password for principal 'host/kerberos@KERBEROS':\"
    send \"admin\n\"
    expect \"Principal 'host/kerberos@KERBEROS' created.\"

    # Create principal root
    expect \"kadmin.local:\"
    send \"addprinc root\n\"
    expect \"Enter password for principal 'root@KERBEROS':\"
    send \"admin\n\"
    expect \"Re-enter password for principal 'root@KERBEROS':\"
    send \"admin\n\"
    expect \"Principal 'root@KERBEROS' created.\"

    # Create principal root/admin
    expect \"kadmin.local:\"
    send \"addprinc root/admin\n\"
    expect \"Enter password for principal 'root/admin@KERBEROS':\"
    send \"admin\n\"
    expect \"Re-enter password for principal 'root/admin@KERBEROS':\"
    send \"admin\n\"
    expect \"Principal 'root/admin@KERBEROS' created.\"

    # Add the host to keytab
    expect \"kadmin.local:\"
    send \"ktadd -k /etc/krb5.keytab host/kerberos\n\"
    expect \"Entry for principal host/kerberos with kvno 2, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/etc/krb5.keytab.\"
    expect \"Entry for principal host/kerberos with kvno 2, encryption type Triple DES cbc mode raw added to keytab WRFILE:/etc/krb5.keytab.\"
    expect \"kadmin.local:\"
    send \"exit\n\"
    expect eof
    exit
    "

    # Keep the eye on the log
    tail -f /var/log/krb5kdc.log
