edseymour / kinit-sidecar Goto Github PK

In the deployment config, its a little confusing, because both the sidecar, and the main application, are using the same image, which is edseymour/kinit-sidecar.

I'm assuming a more real world example would use the kinit-sidecar to augment a main application container which doesnt contain any kerberos dependencies (separation of concerns principle).

So, in the deploymentconfig, the application container, called example-app, runs the following command:

- /bin/sh
          - -c 
          - 'while true; do echo "*** checking if authenticated"; klist ; sleep 5; done'

This command requires klist.

So, the example that you have provided has two containers, both from the same image. One makes the above command, and the other runs rekinit.sh.

The objective, I feel, should be that kerberos is wholly separate from the application container, and the aplication container doesnt need any kerberos dependencies.

Is it possible that the main container can call this in the side-car? The objective being that all kerberos dependencies are contained within the kerberos sidecar.

When in a bash session on the sidecar I can list cache entries:

klist
Ticket cache: FILE:/dev/shm/ccache
Default principal: [email protected]
Valid starting     Expires            Service principal
09/25/18 04:32:18  09/25/18 14:32:18  krbtgt/[email protected]
        renew until 09/26/18 04:32:18

But running the same command on the application container, I get:

klist
klist: Credentials cache permissions incorrect (filename: /dev/shm/ccache)

What permissions does this need?