Установка оператора Kerberos в Kubernetes с помощью CLI

apiVersion: adc.arenadata.io/v1alpha1
kind: KerberosOperator
metadata:
  name: kerberos (1)
  namespace: kerberos-operator (2)
spec:
  image: hub.arenadata.io/adc-enterprise/kerberos-operator:<tag> (3)

  # Number of replicas
  # replicas: 1

  resources:
    limits:
      cpu: 500m
      memory: 256Mi

  # Operator ServiceAccount. create: true (default) also creates the manager and per-payload-namespace Role/RoleBinding bound to it; create: false skips all three - name then refers to a ServiceAccount (and RBAC) managed entirely outside the CLI.
  serviceAccount: (4)
    create: true
    name: "kerberos-operator"

  # Whether the CLI creates the product namespace.
  # The namespace name is set in metadata.namespace.
  namespace:
    create: true

  # Create namespaces to run the payload.
  createPayloadNamespaces: true

  # List of namespaces to run the payload in.
  payloadNamespaces: (5)
    - adh

  ## Image pull secret for a private registry.
  ## Set 'externalSecretName' to reference an existing Secret,
  ## or set 'credentials' and optionally 'secretName' to let the CLI create one.
  #imagePullSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-registry-secret
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-registry-secret
  #
  #  #credentials:
  #  #  registry: registry.example.com
  #  #  username: user
  #  #  password: pass

  ## Operator monitoring configuration. Supports product-specific metrics export and optional vmagent delivery to an external ADM.
  #monitoring:
  #  # Expose the Kerberos operator metrics endpoint on port 8443.
  #  exportMetrics: true
  #
  #  # Renders a namespace-scoped vmagent that sends metrics to an external ADM.
  #  vmagent:
  #    remoteWrite:
  #      url: http://vminsert.example.com/insert/0/prometheus/api/v1/write
  #    scrapeInterval: 15s
  #    image: hub.arenadata.io/adm-enterprise/vmagent:1.136.0-adm-5.0.0-x86_64
  #
  #    ## HTTPS settings used by vmagent when scraping product metrics.
  #    #tls:
  #    #  ## CA certificate source used to verify the metrics endpoint.
  #    #  #ca:
  #    #  #  # Use a Secret managed outside ADC.
  #    #  #  externalSecretName: existing-product-metrics-ca
  #    #  #
  #    #  #  ## Or let ADC create the Secret.
  #    #  #  #secretName: product-metrics-ca
  #    #  #
  #    #  #  # Key containing the CA certificate in the referenced Secret.
  #    #  #  certificateKey: ca.crt
  #    #  #
  #    #  #  ## Local CA certificate read by ADC to create the configured Secret.
  #    #  #  #files:
  #    #  #  #  certificatePath: /path/to/ca.crt
  #    #
  #    #  ## Server name used to verify the metrics endpoint certificate hostname.
  #    #  #serverName: metrics.example.com
  #    #
  #    #  # Skip verification of the metrics endpoint certificate. Do not use together with ca.
  #    #  insecureSkipVerify: true

  ## TLS certificate configuration for metrics endpoint.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  #metricsTLS:
  #  ## Optional name of the Secret ADC creates from local files.
  #  #secretName: custom-metrics-tls-secret
  #  externalSecretName: existing-metrics-tls-secret
  #
  #  # Key in the Secret containing the TLS certificate.
  #  certificateKey: tls.crt
  #
  #  # Key in the Secret containing the TLS private key.
  #  privateKey: tls.key
  #
  #  ## Local files 'adc apply' puts into the Secret named by metricsTLS.secretName.
  #  ## Relative paths are resolved against the config file.
  #  #files:
  #  #  certificatePath: /path/to/tls.crt
  #  #  privateKeyPath: /path/to/tls.key

  ## Defines the Kerberos realm configuration and krb5.conf-related settings.
  kdc: (6)
    realm: AD.RANGER-TEST
    labelSelector:
      env: prod
    realms:
      AD.RANGER-TEST: |-
        kdc = ad01.adsw.io
        admin_server = ad01.adsw.io
    domainRealm:
      ad.ranger-test: AD.RANGER-TEST
    libdefaults:
  #    debug: "false"
      default_realm: AD.RANGER-TEST
  #    default_tgs_enctypes: aes256-cts-hmac-sha1-96
  #    dns_lookup_kdc: "false"

  ## Defines connection and authentication details for the LDAP server (backend for Kerberos KDC).
  ldapSecret: (7)
    secretName: ldap-credentials
    provider: ad
    address: ldaps://ad01.adsw.io:636
    adminUser: stikhomirov@AD.RANGER-TEST
    adminPassword: <password>
    baseDN: cn=users,dc=example,dc=com
  #  ca: ""
  #
  #  # Local file paths consumed by the CLI during 'adc apply'.
  #  # Paths are relative to the config file. The CLI reads this file
  #  # and creates the Secret named by ldapSecret.secretName.
    files:
      certificatePath: /etc/ssl/ldap-ca.pem (8)

---
apiVersion: v1
kind: Namespace
metadata:
  name: kerberos-operator
spec: {}
status: {}
---
apiVersion: v1
kind: Namespace
metadata:
  name: adh
spec: {}
status: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kerberos-operator
  namespace: kerberos-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kerberos-operator-manager
  namespace: kerberos-operator
rules:
- apiGroups:
  - events.k8s.io
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - kdcconfigs
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - kdcconfigs/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - krb5.arenadata.io
  resources:
  - kdcconfigs/finalizers
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kerberos-operator-manager
  namespace: kerberos-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kerberos-operator-manager
subjects:
- kind: ServiceAccount
  name: kerberos-operator
  namespace: kerberos-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kerberos-operator-payload
  namespace: adh
rules:
- apiGroups:
  - events.k8s.io
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - keytabs
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - krb5.arenadata.io
  resources:
  - keytabs/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - krb5.arenadata.io
  resources:
  - keytabs/finalizers
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kerberos-operator-payload
  namespace: adh
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kerberos-operator-payload
subjects:
- kind: ServiceAccount
  name: kerberos-operator
  namespace: kerberos-operator
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: operator
    app.kubernetes.io/managed-by: adc-cli
    arenadata.io/operator-type: kerberos
  name: kerberos-operator
  namespace: kerberos-operator
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: operator
      app.kubernetes.io/managed-by: adc-cli
      app.kubernetes.io/name: kerberos-operator
  strategy: {}
  template:
    metadata:
      labels:
        app.kubernetes.io/component: operator
        app.kubernetes.io/managed-by: adc-cli
        app.kubernetes.io/name: kerberos-operator
    spec:
      containers:
      - args:
        - -ns=adh
        image: hub.arenadata.io/adc-enterprise/kerberos-operator:<tag>
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        name: app
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            cpu: 500m
            memory: 256Mi
          requests:
            cpu: 500m
            memory: 256Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsGroup: 10001
          runAsNonRoot: true
          runAsUser: 10001
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      serviceAccountName: kerberos-operator
      terminationGracePeriodSeconds: 10
status: {}
---
apiVersion: krb5.arenadata.io/v1alpha1
kind: KDCConfig
metadata:
  name: kerberos-kdc
  namespace: kerberos-operator
spec:
  domainRealm:
    ad.ranger-test: AD.RANGER-TEST
  labelSelector:
    env: prod
  libdefaults:
    default_realm: AD.RANGER-TEST
  realm: AD.RANGER-TEST
  realms:
    AD.RANGER-TEST: |-
      kdc = ad01.adsw.io
      admin_server = ad01.adsw.io
---
apiVersion: v1
data:
  ca: <encoded-ca>
kind: Secret
metadata:
  annotations:
    krb5.arenadata.io/provider: ad
  labels:
    env: prod
  name: ldap-credentials
  namespace: kerberos-operator
stringData:
  addr: ldaps://ad01.adsw.io:636
  adminDN: stikhomirov@AD.RANGER-TEST
  adminPW: <password>
  baseDN: cn=users,dc=example,dc=com
type: krb5.arenadata.io/ldap-credentials