stackabletech / stackabletech/secret-operator
Kerberos: Consider PKINIT support?
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 13
- Forks
- 8
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 10
Description
Currently, we always issue Kerberos keytabs, which require us to know the password for each Kerberos user (and prevents us from rotating those passwords, to avoid locking out old pods).
PKINIT would allow us to reuse our existing TLS infrastructure instead, and generate ephemeral keys like we do for TLS.
Open questions:
- Migrating existing application?
- Does Java's Kerberos stack support the extension?
- What about AD?
- We need to give the CA(s) to the KDC (
TrustStore?). - What about Cert-Manager and other out-of-tree issuers?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No implementation files or tests are named. Start by reading the linked MIT PKINIT documentation, then investigate Java Kerberos support, Active Directory compatibility, CA trust configuration for the KDC, and Cert-Manager or other out-of-tree issuers. Done requires resolving the migration and integration questions and defining an implementable scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kubernetes, rust
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100