From 3b6d1df26745063ec7fd9cf2c229f913043e0b4c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Dec 01 2025 15:59:43 +0000 Subject: Drop the create_keytab sop This no longer works well in recent IPA versions as well as we should encourage people to just get a real ticket and renew it. Related: https://pagure.io/fedora-infrastructure/issue/12918 Signed-off-by: Kevin Fenzi --- diff --git a/modules/howtos/pages/create_keytab.adoc b/modules/howtos/pages/create_keytab.adoc deleted file mode 100644 index 9fa60ae..0000000 --- a/modules/howtos/pages/create_keytab.adoc +++ /dev/null @@ -1,40 +0,0 @@ -= How to create a keytab for an user - -First obtain Kerberos ticket with kinit: - ----- -$ kinit myusername@FEDORAPROJECT.ORG -Password for myusername@FEDORAPROJECT.ORG: ----- - -Then obtain kvno value: - ----- -$ kvno myusername@FEDORAPROJECT.ORG -myusername@FEDORAPROJECT.ORG: kvno = 42 ----- - -Ticket is no longer needed and can be destroyed: - ----- -$ kdestroy -p myusername@FEDORAPROJECT.ORG ----- - -Generate keytab and write it to disk: - ----- -$ ktutil -ktutil: addent -password -p myusername@FEDORAPROJECT.ORG -k 42 -f -Password for myusername@FEDORAPROJECT.ORG: -ktutil: wkt /tmp/kt/fedora -ktutil: q ----- - -Done. You can now use the keytab to obtain the ticket without typing password: - ----- -$ kinit -kt /tmp/kt/fedora myusername@FEDORAPROJECT.ORG ----- - - -(source: https://pagure.io/fedora-infrastructure/issue/9544#comment-706949) diff --git a/modules/sysadmin_guide/pages/index.adoc b/modules/sysadmin_guide/pages/index.adoc index 3548200..4f79cba 100644 --- a/modules/sysadmin_guide/pages/index.adoc +++ b/modules/sysadmin_guide/pages/index.adoc @@ -184,7 +184,6 @@ In this section is list of guides for common tasks that are done in Fedora Infra * xref:howtos:check_robosignatory_production_logs.adoc[How to check robosignatory productions logs] * xref:howtos:clean_2f_tokens.adoc[How to remove 2 factor authentication tokens in IPA] * xref:howtos:clean_monitoring_sidetags.adoc[How to clean up the side-tags created by the monitor-gating project] -* xref:howtos:create_keytab.adoc[How to create a keytab for an user] * xref:howtos:create_new_mailing_list.adoc[Creating a new mailing list] * xref:howtos:creating_groups_distgit.adoc[How to create a group in dist-git] * xref:howtos:delete_mailman_thread.adoc[How to delete a thread in mailman] diff --git a/modules/sysadmin_guide/pages/sop_fas2discourse_operator_debugging.adoc b/modules/sysadmin_guide/pages/sop_fas2discourse_operator_debugging.adoc index 1b38700..5b29b8b 100644 --- a/modules/sysadmin_guide/pages/sop_fas2discourse_operator_debugging.adoc +++ b/modules/sysadmin_guide/pages/sop_fas2discourse_operator_debugging.adoc @@ -85,9 +85,7 @@ For local testing, it is necessary to create a secret. For that you have to create a [Discourse API key] (https://meta.discourse.org/t/create-and-configure-an-api-key/230124) (probably in staging Discourse instance) -and a [keytab file] -(https://pagure.io/fedora-infra/howtos/blob/main/f/create_keytab.md) -for kinit. +and a valid kerberos ticket. === Create a secret With command `oc create secret generic`. Let's name it `fas2discourse-operator-discourse-apikey-secret`.