css-test/instruct_kerberos.md

Kerberos auth Airflow supports kerberos auth. To configure it we need standard Service account (gMSA is not supported). in this example BRANCH\zGDSAppDEV user will be used to configure arflow follow next steps:

use airflow user to perform configuration

sudo -iu airflow pwd you should be located in home directory of the airflow user image.png

we now need to create keytab file which will be used to authenticate our service account

ktutil add_entry -password -p zGDSAppDEV@PROD.ASBGROUP.CO.NZ -k 1 -e aes256-cts-hmac-sha1-96 wkt airflow.keytab quit have your service account ready as above commands will ask to enter service account password

check that file was created and you can see content of keytab file which holds Pricipal klist -ekt airflow.keytab image.png

initiate ticket for airflow user

sudo -u airflow kinit zAirflowDEV@PROD.ASBGROUP.CO.NZ -V -k -t /opt/airflow/airflow.keytab -c /opt/airflow/airflow-krb5-ticket.cache now we need configure airflow to use this keytab file. Open airflow configuration file vim airflow.cfg

Then change following keys in config file

security = kerberos ccache = /tmp/airflow_krb5_ccache principal = zAirflowDEV@PROD.ASBGROUP.CO.NZ keytab = /home/airflow/airflow.keytab using your cmf account restart both airflow-scheduler and airflow-webserver services sudo systemctl restart airflow-scheduler airflow-webserver

test that ticket is assigned to airflow user sudo -u airflow klist

configure systemd unit to renew kerberos ticket periodically sudo vim /etc/systemd/system/airflow-kerberos-renewal.service

[Unit] Description=Airflow Kerberos Ticket Renewal Process Requires=network-online.target After=network-online.target

[Service] Type=simple Environment="PATH=$PATH:/opt/airflow/.venv:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin" Environment="AIRFLOW_HOME=/opt/airflow" User=airflow Group=airflow ExecStart=/usr/bin/bash -c 'source /opt/airflow/.venv/bin/activate ; airflow kerberos' Restart=always RestartSec=5s PrivateTmp=true

[Install] WantedBy=multi-user.target Reload daemons sudo systemctl daemon-reload

Start service sudo systemctl enable --now airflow-kerberos-renewal

Check status sudo systemctl status airflow-kerberos-renewal

Useful information for troubleshooting in journal sudo journalctl -u airflow-kerberos-renewal -f

#!/usr/bin/env bash
# =============================================================================
# deploy.sh — Recon Ranger deployment orchestrator
# =============================================================================
#
# Usage:  sudo ./deploy.sh [--clean] [path/to/deploy.conf]
#
# Options:
#   --clean    Remove and recreate the Python venv before installing deps.
#              Useful when a previous deploy left the venv in a broken state.
#
# This script sources deploy.conf for all configuration, then runs each
# deployment step in order. It uses a roll-forward strategy: if a step fails,
# the error is logged and the remaining steps continue.
#
# See deploy.conf.example for the full list of configuration variables.
# =============================================================================

set -uo pipefail

# ---------------------------------------------------------------------------
# Resolve our own location so relative paths work regardless of cwd.
# ---------------------------------------------------------------------------
DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# ---------------------------------------------------------------------------
# Load shared functions
# ---------------------------------------------------------------------------
source "${DEPLOY_DIR}/lib/common.sh"

# ---------------------------------------------------------------------------
# Parse arguments
# ---------------------------------------------------------------------------
DEPLOY_CLEAN=false

while [[ $# -gt 0 ]]; do
    case "$1" in
        --clean) DEPLOY_CLEAN=true; shift ;;
        *)       break ;;
    esac
done

# ---------------------------------------------------------------------------
# Root check
# ---------------------------------------------------------------------------
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root (or via sudo)"
    return 1 2>/dev/null || exit 1
fi

# ---------------------------------------------------------------------------
# Load configuration
# ---------------------------------------------------------------------------
CONF_FILE="${1:-${DEPLOY_DIR}/deploy.conf}"
# Resolve to absolute path so step scripts can find it regardless of cwd.
CONF_FILE="$(readlink -f "$CONF_FILE")"

if [[ ! -f "$CONF_FILE" ]]; then
    log_error "Config file not found: $CONF_FILE"
    log_error "Copy deploy.conf.example to deploy.conf and fill in your values."
    return 1 2>/dev/null || exit 1
fi

log_info "Loading configuration from: $CONF_FILE"
source "$CONF_FILE"

# ---------------------------------------------------------------------------
# Resolve APP_ROOT (repo root + optional subdirectory)
# ---------------------------------------------------------------------------
if [[ -n "${APP_SUBDIR:-}" ]]; then
    APP_ROOT="${APP_DIR}/${APP_SUBDIR}"
    log_info "APP_SUBDIR set — app root resolved to: $APP_ROOT"
else
    APP_ROOT="${APP_DIR}"
fi

# Track whether tests passed — used to gate service restart
DEPLOY_TESTS_PASSED=true

# ---------------------------------------------------------------------------
# Run deployment steps
# ---------------------------------------------------------------------------

log_step "Application Deployment — $(date)"

run_step "0. Proxy Setup"          "${DEPLOY_DIR}/steps/00-proxy-setup.sh"
run_step "1. User Setup"           "${DEPLOY_DIR}/steps/01-user-setup.sh"

if [[ "${APP_SSL_ENABLED:-true}" == "true" ]]; then
    run_step "2. SSL Certificates" "${DEPLOY_DIR}/steps/02-ssl-certs.sh"
else
    log_info "Skipping SSL certificates (APP_SSL_ENABLED=false)"
fi

run_step "3. App Install"          "${DEPLOY_DIR}/steps/03-app-install.sh"
run_step "3a. App Environment"     "${DEPLOY_DIR}/steps/03a-app-env.sh"
run_step "3b. DB Migrations"       "${DEPLOY_DIR}/steps/03b-db-migrate.sh"
run_step "3c. Tests"               "${DEPLOY_DIR}/steps/03c-tests.sh"
run_step "4. Firewall"             "${DEPLOY_DIR}/steps/04-firewall.sh"

if [[ -n "${CIFS_MOUNTS:-}" ]]; then
    run_step "5. Network Mounts"   "${DEPLOY_DIR}/steps/05-network-mounts.sh"
else
    log_info "Skipping network mounts (CIFS_MOUNTS not set)"
fi

run_step "6. App Service"          "${DEPLOY_DIR}/steps/06-app-service.sh"

# ---------------------------------------------------------------------------
# Summary
# ---------------------------------------------------------------------------
echo ""
echo "====================================================================="
if [[ $DEPLOY_HAS_ERRORS -ne 0 ]]; then
    log_warn "Deployment completed with errors — review the log above,"
    log_warn "fix the issue(s), and re-run this script."
    return 1 2>/dev/null || exit 1
else
    log_info "Deployment completed successfully."
fi
echo "====================================================================="

#!/usr/bin/env bash
# =============================================================================
# 01-user-setup.sh — Create the application system user and group
# =============================================================================

require_vars APP_USER APP_GROUP || return 1

# ---- Group ----
if getent group "$APP_GROUP" &>/dev/null; then
    log_info "Group already exists: $APP_GROUP"
else
    log_info "Creating system group: $APP_GROUP"
    groupadd --system "$APP_GROUP" || { log_error "Failed to create group: $APP_GROUP"; return 1; }
fi

# ---- User ----
if id "$APP_USER" &>/dev/null; then
    log_info "User already exists: $APP_USER"
else
    log_info "Creating system user: $APP_USER (group: $APP_GROUP, shell: /sbin/nologin)"
    useradd \
        --system \
        --gid "$APP_GROUP" \
        --shell /sbin/nologin \
        --no-create-home \
        "$APP_USER" \
        || { log_error "Failed to create user: $APP_USER"; return 1; }
fi