Skip to content

Conversation

@nightkr
Copy link
Contributor

@nightkr nightkr commented Feb 12, 2025

Description

Fixes #562

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes
# Author
- [X] Helm chart can be installed and deployed operator works
- [X] Integration tests passed (for non trivial changes)
# Reviewer
- [ ] Code contains useful comments
- [ ] Code contains useful logging statements
- [ ] (Integration-)Test cases added
- [ ] Documentation added or updated. Follows the [style guide](https://docs.stackable.tech/home/nightly/contributor/docs/style-guide).
- [ ] Changelog updated
- [x] Cargo.toml only contains references to git tags (not specific commits or branches)
# Acceptance
- [ ] Feature Tracker has been updated
- [ ] Proper release label has been added
- [ ] [Roadmap](https://github.com/orgs/stackabletech/projects/25/views/1) has been updated

@nightkr nightkr self-assigned this Feb 12, 2025
@nightkr
Copy link
Contributor Author

nightkr commented Feb 12, 2025

Tested against krb5 by applying this:

diff --git a/tests/templates/kuttl/kerberos/01-install-kdc.yaml.j2 b/tests/templates/kuttl/kerberos/01-install-kdc.yaml.j2
index ade1705..51e0d64 100644
--- a/tests/templates/kuttl/kerberos/01-install-kdc.yaml.j2
+++ b/tests/templates/kuttl/kerberos/01-install-kdc.yaml.j2
@@ -33,7 +33,7 @@ spec:
               test -e /var/kerberos/krb5kdc/principal || kdb5_util create -s -P asdf
               kadmin.local get_principal -terse root/admin || kadmin.local add_principal -pw asdf root/admin
               # stackable-secret-operator principal must match the keytab specified in the SecretClass
-              kadmin.local get_principal -terse stackable-secret-operator || kadmin.local add_principal -e aes256-cts-hmac-sha384-192:normal -pw asdf stackable-secret-operator
+              kadmin.local get_principal -terse stackable-secret_operator || kadmin.local add_principal -e aes256-cts-hmac-sha384-192:normal -pw asdf stackable-secret_operator
           env:
             - name: KRB5_CONFIG
               value: /stackable/config/krb5.conf
@@ -143,11 +143,11 @@ data:
     cluster.local = CLUSTER.LOCAL
   kadm5.acl: |
     root/admin *e
-    stackable-secret-operator *e
+    stackable-secret_operator *e
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: secret-operator-keytab
 data:
-  keytab: BQIAAABdAAEADUNMVVNURVIuTE9DQUwAGXN0YWNrYWJsZS1zZWNyZXQtb3BlcmF0b3IAAAABZAYWIgEAFAAgm8MCZ8B//XF1tH92GciD6/usWUNAmBTZnZQxLua2TkgAAAAB
+  keytab: BQIAAABdAAEADUNMVVNURVIuTE9DQUwAGXN0YWNrYWJsZS1zZWNyZXRfb3BlcmF0b3IAAAABZ6xjwgEAFAAgz8mI9b8YpFWDN8PWHkuVeX5GZq/wVu5KDSvxh7v9Bw8AAAAB
diff --git a/tests/templates/kuttl/kerberos/secretclass.yaml b/tests/templates/kuttl/kerberos/secretclass.yaml
index 33a003f..f508177 100644
--- a/tests/templates/kuttl/kerberos/secretclass.yaml
+++ b/tests/templates/kuttl/kerberos/secretclass.yaml
@@ -15,4 +15,4 @@ spec:
       adminKeytabSecret:
         name: secret-operator-keytab
         namespace: $NAMESPACE
-      adminPrincipal: stackable-secret-operator
+      adminPrincipal: stackable-secret_operator

Tested against AD by applying this to https://github.com/stackabletech/ad-init:

diff --git a/roles/ad-dc/tasks/main.yaml b/roles/ad-dc/tasks/main.yaml
index fdde98d..ff04912 100644
--- a/roles/ad-dc/tasks/main.yaml
+++ b/roles/ad-dc/tasks/main.yaml
@@ -16,7 +16,7 @@
 
 - name: Name Secret-Operator User
   set_fact:
-    secret_operator_principal: stackable-secret-operator@{{ ansible_facts.domain | upper }}
+    secret_operator_principal: stackable_secret_operator@{{ ansible_facts.domain | upper }}
 - name: Create Secret-Operator User
   microsoft.ad.user:
     name: stackable-secret-operator

@nightkr nightkr requested a review from a team February 12, 2025 09:16
Copy link
Member

@sbernauer sbernauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome and quick work!
Can you please add a changelog entry?

@nightkr
Copy link
Contributor Author

nightkr commented Feb 12, 2025

Right, knew there was something I forgot

@nightkr nightkr requested a review from sbernauer February 12, 2025 09:23
sbernauer
sbernauer previously approved these changes Feb 12, 2025
Copy link
Member

@sbernauer sbernauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@sbernauer
Copy link
Member

good old changelog conflicts 🙃

@nightkr
Copy link
Contributor Author

nightkr commented Feb 12, 2025

Yuuuhp

@nightkr nightkr added this pull request to the merge queue Feb 12, 2025
Merged via the queue into main with commit 1bea067 Feb 12, 2025
17 checks passed
@nightkr nightkr deleted the bugfix/kerbeos-principal-underscore branch February 12, 2025 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Kerberos Principal Checking is overly restrictive (forbids underscore).

3 participants