Releases · AMRC-FactoryPlus/acs-krb-keys-operator

Extend the KerberosKey CRD to allow Factory+ account information to be specified.
Create an account in the Factory+ services and link it to a Kerberos principal.
Provide a bootstrap script to set up a krbkeys operator on an edge cluster.

Assets 2

11 Jan 12:46

Test cosign Pre-release

Pre-release

Fix cosign on build (#13)

Only run the build on releases, but run for any release.

Assets 2

03 Jul 10:22

Seal secrets to edge clusters.

Add a field to the CRD requesting that the generated secrets are passed to the Edge Deployment Operator for sealing and transport to an edge cluster.

What has changed

The required deployment configuration has changed:
- The operator now requires two ccaches, one with kadmin/admin credentials and one with a TGT. This is because a kadmin ticket must be acquired as initial credentials.
- The name of the kadmin ccache must be passed in the KADMIN_CCACHE environment variable.
- The operator requires a DIRECTORY_URL to bootstrap F+ service discovery.
The CRD has changed and must be updated on the cluster. Note that the ACS Helm chart will not do this automatically.

Assets 2

16 Jun 12:02

Support a new 'Trust' key type, which creates a JSON structure containing the information needed for a cross-realm trust key.
Support server key rotation better by allowing old keys to be left in the keytab for a period of time.
Don't re-key unless it's necessary. Support a forced re-key via an annotation.
Label our secrets, and refuse to edit secrets we didn't label.

Upgrading requires a few shell commands to be run to label any existing secrets.

Assets 2