Remove kerberos/ipa integration

conan/conan.sh

@@ -45,18 +45,9 @@ workdir=${workdir:-~/pool_management}
 # Vault file
 vault_file=${vault_file:-~/secrets/infra-sandbox-vault}
 
-# Kerberos
-kerberos_keytab=${kerberos_keytab:-~/secrets/hostadmin.keytab}
-kerberos_user=${kerberos_user:-hostadmin}
-kerberos_password=${kerberos_password:-}
-
 # Pattern to filter the sandboxes to cleanup
 sandbox_filter=${sandbox_filter:-}
 
-if [ -n "${kerberos_password}" ]; then
-    unset kerberos_keytab
-fi
-
 # Lock timeout:  the number of hours after which a lock on a sandbox expires.
 # For ex: '2': a conan process will have 2h to cleanup the sandbox before another
 # process can claim the sandbox for cleanup.
@@ -82,9 +73,6 @@ export conan_instance
 export dynamodb_profile
 export dynamodb_region
 export dynamodb_table
-export kerberos_keytab
-export kerberos_password
-export kerberos_user
 export lock_timeout
 export max_retries
 export aws_nuke_retries

conan/readme.adoc

@@ -12,7 +12,6 @@ Then it runs link:https://github.com/ekristen/aws-nuke[aws-nuke] to wipe them, a
 
 * link:https://github.com/ekristen/aws-nuke[`aws-nuke`] binary
 * IPA client
-* kerberos, `kinit`
 * link:../readme.adoc[`sandbox-list`] binary
 * link:https://github.com/shenwei356/rush[`rush`] binary (parallel tool)
 
@@ -77,8 +76,6 @@ $ podman run \
     -e conan_instance=container$$ \
     -e AWS_SHARED_CREDENTIALS_FILE=/run/secrets/aws_credentials \
     -e vault_file=/run/secrets/vault_file \
-    -e kerberos_user=... \
-    -e kerberos_password="...." \
     -e workdir=/home/opentlc-mgr/pool_management \
     -e AWSCLI=aws \
     -e threads=1 \

conan/wipe_sandbox.sh

@@ -18,7 +18,6 @@ debug=${debug:-false}
 : "${aws_profile:?"aws_profile is unset or empty"}"
 : "${aws_nuke_binary_path:?"aws_nuke_binary_path is unset or empty"}"
 : "${lock_timeout:?"lock_timeout is unset or empty"}"
-: "${kerberos_user:?"kerberos_user is unset or empty"}"
 : "${vault_file:?"vault_file is unset or empty"}"
 : "${workdir:?"workdir is unset or empty"}"
 
@@ -236,9 +235,6 @@ sandbox_reset() {
         -e output_dir="${workdir}/output_dir_sandbox" \
         -e vault_file="${vault_file}" \
         -e aws_cli="${AWSCLI}" \
-        -e kerberos_keytab="${kerberos_keytab:-}" \
-        -e kerberos_user="${kerberos_user}" \
-        -e kerberos_password="${kerberos_password:-}" \
         -e run_aws_nuke_legacy="${run_aws_nuke_legacy:-false}" \
         reset_single.yml > "${logfile}"; then
         echo "$(date -uIs) ${sandbox} reset OK"

deploy/helm-conan/templates/deployment.yaml

@@ -74,21 +74,9 @@ spec:
         - name: vault_file
           value: /secrets/vault_file/vault_file
 
-        - name: kerberos_user
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.sandbox_conan_secrets.kerberos_secret.name }}
-              key: username
-
         - name: workdir
           value: /home/opentlc-mgr/pool_management
 
-        - name: kerberos_password
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.sandbox_conan_secrets.kerberos_secret.name }}
-              key: password
-
         - name: AWSCLI
           value: {{ .Values.awscli | default "aws" | quote }}
 

deploy/helm-conan/templates/secrets.yaml

@@ -19,25 +19,6 @@ data:
 ---
 apiVersion: v1
 kind: Secret
-metadata:
-  name: {{ .Values.sandbox_conan_secrets.kerberos_secret.name }}
-  namespace: {{ .Values.sandbox_conan_secrets.kerberos_secret.namespace | default .Values.namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Chart.Name }}
-    app.kubernetes.io/version: {{ .Chart.Version | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    meta.helm.sh/release-name: {{ .Release.Name }}
-    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
-    {{- if .Values.labels }}
-    {{- toYaml .Values.labels | nindent 4 }}
-    {{- end }}
-type: Opaque
-data:
-  username: {{ .Values.sandbox_conan_secrets.kerberos_secret.kerberos_user | b64enc | quote }}
-  password: {{ .Values.sandbox_conan_secrets.kerberos_secret.kerberos_password | b64enc | quote }}
----
-apiVersion: v1
-kind: Secret
 metadata:
   name: {{ .Values.sandbox_conan_secrets.vault_secret.name }}
   namespace: {{ .Values.sandbox_conan_secrets.vault_secret.namespace | default .Values.namespace }}

deploy/helm-conan/values.yaml

@@ -31,12 +31,6 @@ sandbox_conan_secrets:
     name: vault-file
     #content: "..."
 
-  kerberos_secrets:
-    #namespace: ...
-    name: kerberos-ipa
-    kerberos_user: "..."
-    #kerberos_password: "..."
-
   aws_credentials:
     #namespace: ...
     name: aws-credentials

playbooks/create_range.yml

@@ -30,6 +30,4 @@
         account_email: sandbox{{account_num}}@opentlc.com
         account_destination_ou: sandboxes
         output_dir: ~/pool_management/output_dir_sandbox
-        kerberos_user: hostadmin
-        kerberos_keytab: ~/secrets/hostadmin.keytab
         operation: CREATE

playbooks/readme.adoc

@@ -17,8 +17,7 @@ sandbox-list -all --sort name |tail
 (python_virtualenv) [opentlc-mgr@admin (PROD) ~]$ cd pool_management/sandbox/playbooks
 
 # .create 10 AWS sandbox accounts: sandbox3001 .. sandbox3010
-# You can use 'IPA opentlc.com hostadmin for conan' for the kerberos creds
-./create_range.yml -e account_num_start=3001 -e account_count=10 -e kerberos_user=... -e kerberos_password=...
+./create_range.yml -e account_num_start=3001 -e account_count=10
 
 # Add GOLD IMAGES to the new accounts
 # Generate the list of new sandboxes

playbooks/reset_single.yml

@@ -17,6 +17,4 @@
         account_email: sandbox{{_account_num}}@opentlc.com
         account_destination_ou: sandboxes
         output_dir: ~/pool_management/output_dir_sandbox
-        kerberos_user: hostadmin
-        kerberos_keytab: ~/secrets/hostadmin.keytab
         operation: RESET

playbooks/roles/infra-aws-sandbox/README.adoc

@@ -21,8 +21,6 @@ ansible localhost \
 ansible -i admin-dev, admin-dev \
 -m include_role -a "name=infra-aws-sandbox" \
 -e ansible_user=gucore-redhat.com \
--e kerberos_user=gucore-redhat.com \
--e kerberos_password=... \
 -e aws_master_profile=pool-manager-admin \
 -e account_name=sandbox2 \
 -e account_email=sandbox2@opentlc.com \
@@ -58,8 +56,6 @@ ansible -i admin-dev, admin-dev \
 ansible -i admin-dev, admin-dev \
 -m include_role -a "name=infra-aws-sandbox" \
 -e ansible_user=gucore-redhat.com \
--e kerberos_user=gucore-redhat.com \
--e kerberos_password=... \
 -e aws_master_profile=pool-manager-admin \
 -e account_name=sandbox2 \
 -e account_email=sandbox2@opentlc.com \

playbooks/roles/infra-aws-sandbox/tasks/main.yml

@@ -21,9 +21,4 @@
 - include_tasks: keypair.yml
   when: operation in ['CREATE', 'RESET']
   tags: keypair
-- include_tasks: ipa.yml
-  tags: ipa
-  when:
-    - kerberos_user is defined
-    - kerberos_password | default("", true) != "" or kerberos_keytab | default("", true) != ""
 - import_tasks: pool.yml

playbooks/roles/infra-aws-sandbox/tasks/pre_checks.yml

@@ -13,9 +13,3 @@
 - assert:
     that: r_path.stat.exists
     msg: "{{ vault_file }} doesn't exist, please create it"
-
-- include_tasks: test_ipa.yml
-  tags: ipa
-  when:
-    - kerberos_user is defined
-    - kerberos_password | default("", true) != "" or kerberos_keytab | default("") != ""