GHP publish
This commit is contained in:
21
openldap/.helmignore
Normal file
21
openldap/.helmignore
Normal file
@ -0,0 +1,21 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
14
openldap/Chart.yaml
Normal file
14
openldap/Chart.yaml
Normal file
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
name: openldap
|
||||
home: https://www.openldap.org
|
||||
version: 1.2.7
|
||||
appVersion: 2.4.48
|
||||
description: DEPRECATED - Community developed LDAP software
|
||||
icon: http://www.openldap.org/images/headers/LDAPworm.gif
|
||||
keywords:
|
||||
- ldap
|
||||
- openldap
|
||||
sources:
|
||||
- https://github.com/kubernetes/charts
|
||||
deprecated: true
|
||||
engine: gotpl
|
110
openldap/README.md
Normal file
110
openldap/README.md
Normal file
@ -0,0 +1,110 @@
|
||||
# ⚠️ Repo Archive Notice
|
||||
|
||||
As of Nov 13, 2020, charts in this repo will no longer be updated.
|
||||
For more information, see the Helm Charts [Deprecation and Archive Notice](https://github.com/helm/charts#%EF%B8%8F-deprecation-and-archive-notice), and [Update](https://helm.sh/blog/charts-repo-deprecation/).
|
||||
|
||||
# OpenLDAP Helm Chart
|
||||
|
||||
## DEPRECATION NOTICE
|
||||
|
||||
This chart is deprecated and no longer supported.
|
||||
|
||||
## Prerequisites Details
|
||||
* Kubernetes 1.8+
|
||||
* PV support on the underlying infrastructure
|
||||
|
||||
## Chart Details
|
||||
This chart will do the following:
|
||||
|
||||
* Instantiate an instance of OpenLDAP server
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```bash
|
||||
$ helm install --name my-release stable/openldap
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
We use the docker images provided by https://github.com/osixia/docker-openldap. The docker image is highly configurable and well documented. Please consult to documentation for the docker image for more information.
|
||||
|
||||
The following table lists the configurable parameters of the openldap chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
|
||||
| `replicaCount` | Number of replicas | `1` |
|
||||
| `strategy` | Deployment strategy | `{}` |
|
||||
| `image.repository` | Container image repository | `osixia/openldap` |
|
||||
| `image.tag` | Container image tag | `1.1.10` |
|
||||
| `image.pullPolicy` | Container pull policy | `IfNotPresent` |
|
||||
| `extraLabels` | Labels to add to the Resources | `{}` |
|
||||
| `podAnnotations` | Annotations to add to the pod | `{}` |
|
||||
| `existingSecret` | Use an existing secret for admin and config user passwords | `""` |
|
||||
| `service.annotations` | Annotations to add to the service | `{}` |
|
||||
| `service.clusterIP` | IP address to assign to the service | `nil` |
|
||||
| `service.externalIPs` | Service external IP addresses | `[]` |
|
||||
| `service.ldapPort` | External service port for LDAP | `389` |
|
||||
| `service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `service.loadBalancerSourceRanges` | List of IP CIDRs allowed access to load balancer (if supported) | `[]` |
|
||||
| `service.sslLdapPort` | External service port for SSL+LDAP | `636` |
|
||||
| `service.type` | Service type | `ClusterIP` |
|
||||
| `env` | List of key value pairs as env variables to be sent to the docker image. See https://github.com/osixia/docker-openldap for available ones | `[see values.yaml]` |
|
||||
| `logLevel` | Set the container log level. Valid values: `none`, `error`, `warning`, `info`, `debug`, `trace` | `info` |
|
||||
| `tls.enabled` | Set to enable TLS/LDAPS - should also set `tls.secret` | `false` |
|
||||
| `tls.secret` | Secret containing TLS cert and key (eg, generated via cert-manager) | `""` |
|
||||
| `tls.CA.enabled` | Set to enable custom CA crt file - should also set `tls.CA.secret` | `false` |
|
||||
| `tls.CA.secret` | Secret containing CA certificate (ca.crt) | `""` |
|
||||
| `adminPassword` | Password for admin user. Unset to auto-generate the password | None |
|
||||
| `configPassword` | Password for config user. Unset to auto-generate the password | None |
|
||||
| `customLdifFiles` | Custom ldif files to seed the LDAP server. List of filename -> data pairs | None |
|
||||
| `persistence.enabled` | Whether to use PersistentVolumes or not | `false` |
|
||||
| `persistence.storageClass` | Storage class for PersistentVolumes. | `<unset>` |
|
||||
| `persistence.accessMode` | Access mode for PersistentVolumes | `ReadWriteOnce` |
|
||||
| `persistence.size` | PersistentVolumeClaim storage size | `8Gi` |
|
||||
| `persistence.existingClaim` | An Existing PVC name for openLDAPA volume | None |
|
||||
| `resources` | Container resource requests and limits in yaml | `{}` |
|
||||
| `initResources` | initContainer resource requests and limits in yaml | `{}` |
|
||||
| `test.enabled` | Conditionally provision test resources | `false` |
|
||||
| `test.image.repository` | Test container image requires bats framework | `dduportal/bats` |
|
||||
| `test.image.tag` | Test container tag | `0.4.0` |
|
||||
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
|
||||
|
||||
```bash
|
||||
$ helm install --name my-release -f values.yaml stable/openldap
|
||||
```
|
||||
|
||||
> **Tip**: You can use the default [values.yaml](values.yaml)
|
||||
|
||||
|
||||
## Cleanup orphaned Persistent Volumes
|
||||
|
||||
Deleting the Deployment will not delete associated Persistent Volumes if persistence is enabled.
|
||||
|
||||
Do the following after deleting the chart release to clean up orphaned Persistent Volumes.
|
||||
|
||||
```bash
|
||||
$ kubectl delete pvc -l release=${RELEASE-NAME}
|
||||
```
|
||||
|
||||
## Custom Secret
|
||||
|
||||
`existingSecret` can be used to override the default secret.yaml provided
|
||||
|
||||
## Testing
|
||||
|
||||
Helm tests are included and they confirm connection to slapd.
|
||||
|
||||
```bash
|
||||
helm install . --set test.enabled=true
|
||||
helm test <RELEASE_NAME>
|
||||
RUNNING: foolish-mouse-openldap-service-test-akmms
|
||||
PASSED: foolish-mouse-openldap-service-test-akmms
|
||||
```
|
||||
|
||||
It will confirm that we can do an ldapsearch with the default credentials
|
20
openldap/templates/NOTES.txt
Normal file
20
openldap/templates/NOTES.txt
Normal file
@ -0,0 +1,20 @@
|
||||
OpenLDAP has been installed. You can access the server from within the k8s cluster using:
|
||||
|
||||
{{ template "openldap.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }}
|
||||
|
||||
|
||||
You can access the LDAP adminPassword and configPassword using:
|
||||
|
||||
kubectl get secret --namespace {{ .Release.Namespace }} {{ template "openldap.secretName" . }} -o jsonpath="{.data.LDAP_ADMIN_PASSWORD}" | base64 --decode; echo
|
||||
kubectl get secret --namespace {{ .Release.Namespace }} {{ template "openldap.secretName" . }} -o jsonpath="{.data.LDAP_CONFIG_PASSWORD}" | base64 --decode; echo
|
||||
|
||||
|
||||
You can access the LDAP service, from within the cluster (or with kubectl port-forward) with a command like (replace password and domain):
|
||||
ldapsearch -x -H ldap://{{ template "openldap.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }} -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w $LDAP_ADMIN_PASSWORD
|
||||
|
||||
|
||||
Test server health using Helm test:
|
||||
helm test {{ .Release.Name }}
|
||||
|
||||
|
||||
You can also consider installing the helm chart for phpldapadmin to manage this instance of OpenLDAP, or install Apache Directory Studio, and connect using kubectl port-forward.
|
40
openldap/templates/_helpers.tpl
Normal file
40
openldap/templates/_helpers.tpl
Normal file
@ -0,0 +1,40 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "openldap.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "openldap.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "openldap.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Generate chart secret name
|
||||
*/}}
|
||||
{{- define "openldap.secretName" -}}
|
||||
{{ default (include "openldap.fullname" .) .Values.existingSecret }}
|
||||
{{- end -}}
|
23
openldap/templates/configmap-customldif.yaml
Normal file
23
openldap/templates/configmap-customldif.yaml
Normal file
@ -0,0 +1,23 @@
|
||||
#
|
||||
# A ConfigMap spec for openldap slapd that map directly to files under
|
||||
# /container/service/slapd/assets/config/bootstrap/ldif/custom
|
||||
#
|
||||
{{- if .Values.customLdifFiles }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-customldif
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- range $key, $val := .Values.customLdifFiles }}
|
||||
{{ $key }}: |-
|
||||
{{ $val | indent 4}}
|
||||
{{- end }}
|
||||
{{- end }}
|
20
openldap/templates/configmap-env.yaml
Normal file
20
openldap/templates/configmap-env.yaml
Normal file
@ -0,0 +1,20 @@
|
||||
#
|
||||
# A ConfigMap spec for openldap slapd that map directly to env variables in the Pod.
|
||||
# List of environment variables supported is from the docker image:
|
||||
# https://github.com/osixia/docker-openldap#beginner-guide
|
||||
# Note that passwords are defined as secrets
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-env
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{ toYaml .Values.env | indent 2 }}
|
177
openldap/templates/deployment.yaml
Normal file
177
openldap/templates/deployment.yaml
Normal file
@ -0,0 +1,177 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- if .Values.strategy }}
|
||||
strategy:
|
||||
{{ toYaml .Values.strategy | indent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/configmap-env: {{ include (print $.Template.BasePath "/configmap-env.yaml") . | sha256sum }}
|
||||
{{- if .Values.customLdifFiles}}
|
||||
checksum/configmap-customldif: {{ include (print $.Template.BasePath "/configmap-customldif.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.podAnnotations}}
|
||||
{{ toYaml .Values.podAnnotations | indent 8}}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
{{- if or .Values.customLdifFiles .Values.tls.enabled }}
|
||||
initContainers:
|
||||
{{- end }}
|
||||
{{- if .Values.customLdifFiles }}
|
||||
- name: {{ .Chart.Name }}-init-ldif
|
||||
image: busybox
|
||||
command: ['sh', '-c', 'cp /customldif/* /ldifworkingdir']
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
- name: customldif
|
||||
mountPath: /customldif
|
||||
- name: ldifworkingdir
|
||||
mountPath: /ldifworkingdir
|
||||
resources:
|
||||
{{ toYaml .Values.initResources | indent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: {{ .Chart.Name }}-init-tls
|
||||
image: busybox
|
||||
command: ['sh', '-c', 'cp /tls/* /certs']
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
- name: tls
|
||||
mountPath: /tls
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
resources:
|
||||
{{ toYaml .Values.initResources | indent 10 }}
|
||||
{{- if .Values.tls.CA.enabled }}
|
||||
- name: {{ .Chart.Name }}-init-catls
|
||||
image: busybox
|
||||
command: ['sh', '-c', 'cp /catls/ca.crt /certs']
|
||||
volumeMounts:
|
||||
- name: catls
|
||||
mountPath: /catls
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
resources:
|
||||
{{ toYaml .Values.initResources | indent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- -l
|
||||
- {{ .Values.logLevel }}
|
||||
{{- if .Values.customLdifFiles }}
|
||||
- --copy-service
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: ldap-port
|
||||
containerPort: 389
|
||||
- name: ssl-ldap-port
|
||||
containerPort: 636
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ template "openldap.fullname" . }}-env
|
||||
- secretRef:
|
||||
name: {{ template "openldap.secretName" . }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/ldap
|
||||
subPath: data
|
||||
- name: data
|
||||
mountPath: /etc/ldap/slapd.d
|
||||
subPath: config-data
|
||||
{{- if .Values.customLdifFiles }}
|
||||
- name: ldifworkingdir
|
||||
mountPath: /container/service/slapd/assets/config/bootstrap/ldif/custom
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: certs
|
||||
mountPath: /container/service/slapd/assets/certs
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: LDAP_TLS_CRT_FILENAME
|
||||
value: tls.crt
|
||||
- name: LDAP_TLS_KEY_FILENAME
|
||||
value: tls.key
|
||||
{{- if .Values.tls.CA.enabled }}
|
||||
- name: LDAP_TLS_CA_CRT_FILENAME
|
||||
value: ca.crt
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: ldap-port
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
failureThreshold: 10
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: ldap-port
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
failureThreshold: 10
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.customLdifFiles }}
|
||||
- name: customldif
|
||||
configMap:
|
||||
name: {{ template "openldap.fullname" . }}-customldif
|
||||
- name: ldifworkingdir
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: {{ .Values.tls.secret }}
|
||||
{{- if .Values.tls.CA.enabled }}
|
||||
- name: catls
|
||||
secret:
|
||||
secretName: {{ .Values.tls.CA.secret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: certs
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.existingClaim | default (include "openldap.fullname" .) }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end -}}
|
27
openldap/templates/pvc.yaml
Normal file
27
openldap/templates/pvc.yaml
Normal file
@ -0,0 +1,27 @@
|
||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode | quote }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.persistence.storageClass }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
18
openldap/templates/secret.yaml
Normal file
18
openldap/templates/secret.yaml
Normal file
@ -0,0 +1,18 @@
|
||||
{{ if not .Values.existingSecret }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
LDAP_ADMIN_PASSWORD: {{ .Values.adminPassword | default (randAlphaNum 32) | b64enc | quote }}
|
||||
LDAP_CONFIG_PASSWORD: {{ .Values.configPassword | default (randAlphaNum 32) | b64enc | quote }}
|
||||
{{ end }}
|
44
openldap/templates/service.yaml
Normal file
44
openldap/templates/service.yaml
Normal file
@ -0,0 +1,44 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
{{- if .Values.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
name: {{ template "openldap.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.service.clusterIP }}
|
||||
clusterIP: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.externalIPs }}
|
||||
externalIPs:
|
||||
{{ toYaml .Values.service.externalIPs | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{ toYaml .Values.service.loadBalancerSourceRanges | indent 4 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: ldap-port
|
||||
protocol: TCP
|
||||
port: {{ .Values.service.ldapPort }}
|
||||
targetPort: ldap-port
|
||||
- name: ssl-ldap-port
|
||||
protocol: TCP
|
||||
port: {{ .Values.service.sslLdapPort }}
|
||||
targetPort: ssl-ldap-port
|
||||
selector:
|
||||
app: {{ template "openldap.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
type: {{ .Values.service.type }}
|
50
openldap/templates/tests/openldap-test-runner.yaml
Normal file
50
openldap/templates/tests/openldap-test-runner.yaml
Normal file
@ -0,0 +1,50 @@
|
||||
{{- if .Values.test.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ template "openldap.fullname" . }}-test-{{ randAlphaNum 5 | lower }}"
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
initContainers:
|
||||
- name: test-framework
|
||||
image: {{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}
|
||||
command:
|
||||
- "bash"
|
||||
- "-c"
|
||||
- |
|
||||
set -ex
|
||||
# copy bats to tools dir
|
||||
cp -R /usr/local/libexec/ /tools/bats/
|
||||
volumeMounts:
|
||||
- mountPath: /tools
|
||||
name: tools
|
||||
containers:
|
||||
- name: {{ .Release.Name }}-test
|
||||
image: {{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ template "openldap.secretName" . }}
|
||||
command: ["/tools/bats/bats", "-t", "/tests/run.sh"]
|
||||
volumeMounts:
|
||||
- mountPath: /tests
|
||||
name: tests
|
||||
readOnly: true
|
||||
- mountPath: /tools
|
||||
name: tools
|
||||
volumes:
|
||||
- name: tests
|
||||
configMap:
|
||||
name: {{ template "openldap.fullname" . }}-tests
|
||||
- name: tools
|
||||
emptyDir: {}
|
||||
restartPolicy: Never
|
||||
{{- end -}}
|
22
openldap/templates/tests/openldap-tests.yaml
Normal file
22
openldap/templates/tests/openldap-tests.yaml
Normal file
@ -0,0 +1,22 @@
|
||||
{{- if .Values.test.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-tests
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.extraLabels }}
|
||||
{{ toYaml .Values.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
run.sh: |-
|
||||
@test "Testing connecting to slapd server" {
|
||||
# Ideally, this should be in the docker image, but there is not a generic image we can use
|
||||
# with bats and ldap-utils installed. It is not worth for now to push an image for this.
|
||||
apt-get update && apt-get install -y ldap-utils
|
||||
ldapsearch -x -H ldap://{{ template "openldap.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }} -b "dc=example,dc=org" -D "cn=admin,dc=example,dc=org" -w $LDAP_ADMIN_PASSWORD
|
||||
}
|
||||
{{- end -}}
|
120
openldap/values.yaml
Normal file
120
openldap/values.yaml
Normal file
@ -0,0 +1,120 @@
|
||||
# Default values for openldap.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
# Define deployment strategy - IMPORTANT: use rollingUpdate: null when use Recreate strategy.
|
||||
# It prevents from merging with existing map keys which are forbidden.
|
||||
strategy: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxSurge: 1
|
||||
# maxUnavailable: 0
|
||||
#
|
||||
# or
|
||||
#
|
||||
# type: Recreate
|
||||
# rollingUpdate: null
|
||||
image:
|
||||
# From repository https://github.com/osixia/docker-openldap
|
||||
repository: osixia/openldap
|
||||
tag: 1.2.4
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Spcifies an existing secret to be used for admin and config user passwords
|
||||
existingSecret: ""
|
||||
|
||||
# settings for enabling TLS
|
||||
tls:
|
||||
enabled: false
|
||||
secret: "" # The name of a kubernetes.io/tls type secret to use for TLS
|
||||
CA:
|
||||
enabled: false
|
||||
secret: "" # The name of a generic secret to use for custom CA certificate (ca.crt)
|
||||
## Add additional labels to all resources
|
||||
extraLabels: {}
|
||||
## Add additional annotations to pods
|
||||
podAnnotations: {}
|
||||
service:
|
||||
annotations: {}
|
||||
|
||||
ldapPort: 389
|
||||
sslLdapPort: 636 # Only used if tls.enabled is true
|
||||
## List of IP addresses at which the service is available
|
||||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
type: ClusterIP
|
||||
|
||||
# Default configuration for openldap as environment variables. These get injected directly in the container.
|
||||
# Use the env variables from https://github.com/osixia/docker-openldap#beginner-guide
|
||||
env:
|
||||
LDAP_ORGANISATION: "Example Inc."
|
||||
LDAP_DOMAIN: "example.org"
|
||||
LDAP_BACKEND: "hdb"
|
||||
LDAP_TLS: "true"
|
||||
LDAP_TLS_ENFORCE: "false"
|
||||
LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
|
||||
|
||||
# Default Passwords to use, stored as a secret. If unset, passwords are auto-generated.
|
||||
# You can override these at install time with
|
||||
# helm install openldap --set openldap.adminPassword=<passwd>,openldap.configPassword=<passwd>
|
||||
# adminPassword: admin
|
||||
# configPassword: config
|
||||
|
||||
# Custom openldap configuration files used to override default settings
|
||||
# customLdifFiles:
|
||||
# 01-default-users.ldif: |-
|
||||
# Predefine users here
|
||||
|
||||
## Persist data to a persistent volume
|
||||
persistence:
|
||||
enabled: false
|
||||
## database data Persistent Volume Storage Class
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
# storageClass: "-"
|
||||
accessMode: ReadWriteOnce
|
||||
size: 8Gi
|
||||
# existingClaim: ""
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: "100m"
|
||||
# memory: "256Mi"
|
||||
# limits:
|
||||
# cpu: "500m"
|
||||
# memory: "512Mi"
|
||||
|
||||
initResources: {}
|
||||
# requests:
|
||||
# cpu: "100m"
|
||||
# memory: "128Mi"
|
||||
# limits:
|
||||
# cpu: "100m"
|
||||
# memory: "128Mi"
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
## test container details
|
||||
test:
|
||||
enabled: false
|
||||
image:
|
||||
repository: dduportal/bats
|
||||
tag: 0.4.0
|
||||
|
||||
# Set the container log level
|
||||
# Valid log levels: none, error, warning, info (default), debug, trace
|
||||
logLevel: info
|
Reference in New Issue
Block a user