Allow the configuration of multiple KDCs

[siegfriedweber]

Only one KDC can be set in a SecretClass:

---
apiVersion: secrets.stackable.tech/v1alpha1
kind: SecretClass
spec:
  backend:
    kerberosKeytab:
      kdc: KDC1.MY.REALM.COM

In a krb5.conf, multiple KDCs can be given:

[realms]

MY.REALM.COM = {
kdc = KDC1.MY.REALM.COM
kdc = KDC2.MY.REALM.COM
}

To support high availability, it should be possible to also define multiple KDCs in a SecretClass.

[fetzerms]

Additionally to (statically) defining multiple KDCs, it would be great if SRV records could be used to look up KDCs. Same would also be good for ldap and kadmin entries.

In bigger infrastructures (such as ours) the list of KDCs is not very static but quite dynamic. For example example: dig srv _kerberos._tcp.our.big.corp returns >50 results.

[nightkr]

@fetzerms Hm, that's a fair point but I'd break it out into its own issue.

[mbaeuerle]

Wouldn't it make sense to reference a krb5.conf where also other options can be set instead of only adding some configuration variants like the static KDCs into the SecretClass?
For example: Currently in case there are multiple realms and trust relations only the kdc at the entry level can be specified. Every kdc on a higher level seems to be automatically determined by SRV records without a way adapt it.

The krb5.conf is already the standard configuration for other services like a hive cluster. And by fetching these config options from a krb5.conf every user can set all options they desire.

As the adminPrincipal's keytab is already referenced in a K8s secret, the krb5.conf could be placed inside as well:
https://docs.stackable.tech/home/nightly/secret-operator/secretclass/#format-kerberos