A summary of what I have worked on and learnt this month.

Maven archetypes

For a client project I have created a Maven archetype that is reusable across integrations. It generates a Spring Boot project using Apache Camel, with integration tests set up using WireMock. It also includes the Kubernetes manifests (deployment, mock deployment, etc.) needed to deploy to their dev, test and prod environments.

Since most integrations for this department are very similar, a shared archetype saves a lot of time and tedious setup. It also has the benefit of making the projects consistent. I plan on regenerating each existing integration from the archetype and moving the implementation code into the generated project.

OpenTelemetry

I have started setting up OpenTelemetry for the same department. This lets us correlate requests across the different layers of an integration. I have also set up baggage propagation for some operational information, so we can follow it across the infrastructure.

kinit and Kerberos ticket handling

One pretty central system only supports authentication via Kerberos/SPNEGO. This is a first for me, so I put together a small command to make requesting a ticket easier.

We store the password for the test environment as a SealedSecret, which is unsealed into a regular Kubernetes Secret in the cluster. This command fetches that secret, base64 decodes it and pipes it to kinit:

kubectl -n <namespace> get secret <secret-name> \
        -o jsonpath='{.data.PASSWORD}' \
        | base64 -d \
        | kinit --password-file=STDIN placeholder@EXAMPLE.COM

Note that --password-file is a Heimdal kinit flag, and Heimdal is the default on macOS. MIT Kerberos, which most Linux distributions use, doesn’t support it.

You can list your cached tickets with klist, which also shows when they expire.

To call an endpoint that uses Kerberos/SPNEGO authentication with curl, use the following flags:

  • --negotiate: enables SPNEGO authentication. Curl responds to the server’s WWW-Authenticate: Negotiate challenge with a token.
  • -u :: sets an empty username and password. This looks weird, but it’s required, because curl only activates authentication when -u is present. The empty value tells curl to use the Kerberos ticket from your credential cache instead of real credentials.
curl --negotiate -u : \
    'https://example.org/placeholder/endpoint'