[Bug]: An unwanted user exists in keytab

[whg517]

Desc

Get two keytabs using two volumes in a pod. A keytab may appear containing all kerberos users.

The temporary file name found in the source code when keytab is generated is a unix timestamp, and keytab data is written to the same file name when concurrent operations occur.

solution

Use uuid as file name or hash based on kerberos service name. It is best to use uuid generation to generate random values.

ref

secret-operator/pkg/kerberos/kadmin.go

Lines 127 to 135 in 2466ed4

	// Ktadd generates a keytab file for the given principals
	// Usage: ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] [-norandkey] [principal | -glob princ-exp] [...]
	func (k *Kadmin) Ktadd(principals ...string) ([]byte, error) {
	keytab := path.Join(os.TempDir(), strconv.FormatInt(time.Now().Unix(), 10)+".keytab")
	defer func() {
	if err := os.Remove(keytab); err != nil {
	kadminLogger.Error(err, "Failed to remove keytab")
	}
	}()