container/builder: switch to kerberos auth

Instead of using client certificates, use kerberos auth.

container/builder/Dockerfile

@@ -14,5 +14,6 @@ RUN dnf -y upgrade \
 COPY container/builder/kojid.conf /etc/kojid/kojid.conf
 COPY plugins/builder/osbuild.py /usr/lib/koji-builder-plugins/
 COPY container/builder/run-kojid.sh /app/run-kojid.sh
+COPY container/builder/osbuild.krb5.conf /etc/krb5.conf.d/
 
 ENTRYPOINT /app/run-kojid.sh

container/builder/kojid.conf

@@ -1,13 +1,15 @@
 [kojid]
-server=http://localhost/kojihub
-user = b1.localhost
-topurl=http://localhost/kojifiles
+server=http://org.osbuild.koji.koji/kojihub
+topurl=http://org.osbuild.koji.koji/kojifiles
 
 workdir=/tmp/koji
 topdir=/mnt/koji
 
-cert = /share/ssl/kojid/client.pem
-ca = /share/ssl/kojid/serverca.crt
-serverca = /share/ssl/kojid/serverca.crt
+host_principal_format = compile/%s@LOCAL
+keytab = /share/kojid.keytab
 
-plugins = osbuild
+; cert = /share/ssl/kojid/client.pem
+; ca = /share/ssl/kojid/serverca.crt
+serverca = /share/ca-crt.pem
+
+plugins = osbuild

container/builder/osbuild.krb5.conf

@@ -0,0 +1,5 @@
+[realms]
+LOCAL = {
+    kdc = org.osbuild.koji.kdc
+    admin_server = org.osbuild.koji.kdc
+}

container/builder/run-kojid.sh

@@ -1,16 +1,16 @@
 #!/bin/bash
 set -eux
 
-koji --server=http://localhost/kojihub \
+koji --server=http://org.osbuild.koji.koji/kojihub \
      --user=kojiadmin \
      --password=kojipass \
      --authtype=password \
-     add-host kojid i386 x86_64 || true
+     add-host org.osbuild.koji.kojid i386 x86_64 || true
 
-koji --server=http://localhost/kojihub \
+koji --server=http://org.osbuild.koji.koji/kojihub \
      --user=kojiadmin \
      --password=kojipass \
      --authtype=password \
-     add-host-to-channel kojid image || true
+     add-host-to-channel org.osbuild.koji.kojid image || true
 
 /usr/sbin/kojid -d -v -f --force-lock || cat /var/log/kojid.log