mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/postgresql] Add ldap support to postgresql chart (#18813)
* Add ldap support for postgres chart Signed-off-by: Rafael Rios Saavedra <rafael.rios.saavedra@gmail.com> * Adds validation to ldap configuration method. Fix minor details. Signed-off-by: Rafael Rios Saavedra <rafael.rios.saavedra@gmail.com> * Bump minor version. Fix simultaneous ldap.url and ldap.server checking Signed-off-by: Rafael Rios Saavedra <rafael.rios.saavedra@gmail.com> * Fix condition in ldap.url and ldap.server testing Signed-off-by: Rafael Rios Saavedra <rafael.rios.saavedra@gmail.com>
This commit is contained in:
Rafael Ríos Saavedra
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
56c1a185c1
commit
903dbd4087
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: postgresql
|
||||
version: 7.0.2
|
||||
version: 7.1.0
|
||||
appVersion: 11.5.0
|
||||
description: Chart for PostgreSQL, an object-relational database management system (ORDBMS) with an emphasis on extensibility and on standards-compliance.
|
||||
keywords:
|
||||
|
||||
@@ -70,6 +70,20 @@ The following tables lists the configurable parameters of the PostgreSQL chart a
|
||||
| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` |
|
||||
| `volumePermissions.securityContext.runAsUser` | User ID for the init container | `0` |
|
||||
| `usePasswordFile` | Have the secrets mounted as a file instead of env vars | `false` |
|
||||
| `ldap.enabled` | Enable LDAP support | `false` |
|
||||
| `ldap.existingSecret` | Name of existing secret to use for LDAP passwords | `nil` |
|
||||
| `ldap.url` | LDAP URL beginning in the form `ldap[s]://host[:port]/basedn[?[attribute][?[scope][?[filter]]]]` | `nil` |
|
||||
| `ldap.server` | IP address or name of the LDAP server. | `nil` |
|
||||
| `ldap.port` | Port number on the LDAP server to connect to | `nil` |
|
||||
| `ldap.scheme` | Set to `ldaps` to use LDAPS. | `nil` |
|
||||
| `ldap.tls` | Set to `1` to use TLS encryption | `nil` |
|
||||
| `ldap.prefix` | String to prepend to the user name when forming the DN to bind | `nil` |
|
||||
| `ldap.suffix` | String to append to the user name when forming the DN to bind | `nil` |
|
||||
| `ldap.search_attr` | Attribute to match agains the user name in the search | `nil` |
|
||||
| `ldap.search_filter` | The search filter to use when doing search+bind authentication | `nil` |
|
||||
| `ldap.baseDN` | Root DN to begin the search for the user in | `nil` |
|
||||
| `ldap.bindDN` | DN of user to bind to LDAP | `nil` |
|
||||
| `ldap.bind_password` | Password for the user to bind to LDAP | `nil` |
|
||||
| `replication.enabled` | Enable replication | `false` |
|
||||
| `replication.user` | Replication user | `repl_user` |
|
||||
| `replication.password` | Replication user password | `repl_password` |
|
||||
@@ -375,6 +389,10 @@ $ helm upgrade my-release bitnami/influxdb \
|
||||
|
||||
> Note: you need to substitute the placeholders _[POSTGRESQL_PASSWORD]_, and _[REPLICATION_PASSWORD]_ with the values obtained from instructions in the installation notes.
|
||||
|
||||
## 7.1.0
|
||||
|
||||
Adds support for LDAP configuration.
|
||||
|
||||
## 7.0.0
|
||||
|
||||
Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec.
|
||||
|
||||
@@ -42,6 +42,8 @@ To connect to your database from outside the cluster execute the following comma
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- include "postgresql.validateValues" . -}}
|
||||
|
||||
{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
|
||||
WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
|
||||
@@ -372,3 +372,29 @@ Return the appropriate apiVersion for statefulset.
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
{{- define "postgresql.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "postgresql.validateValues.ldapConfigurationMethod" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate values of Postgresql - If ldap.url is used then you don't need the other settings for ldap
|
||||
*/}}
|
||||
{{- define "postgresql.validateValues.ldapConfigurationMethod" -}}
|
||||
{{- if and .Values.ldap.enabled (and (not (empty .Values.ldap.url)) (not (empty .Values.ldap.server))) }}
|
||||
postgresql: ldap.url, ldap.server
|
||||
You cannot set both `ldap.url` and `ldap.server` at the same time.
|
||||
Please provide a unique way to configure LDAP.
|
||||
More info at https://www.postgresql.org/docs/current/auth-ldap.html
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -14,4 +14,7 @@ data:
|
||||
{{- if .Values.replication.enabled }}
|
||||
postgresql-replication-password: {{ include "postgresql.replication.password" . | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if (and .Values.ldap.enabled .Values.ldap.bind_password)}}
|
||||
postgresql-ldap-password: {{ .Values.ldap.bind_password | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
@@ -174,6 +174,41 @@ spec:
|
||||
{{- if .Values.extraEnv }}
|
||||
{{- include "postgresql.tplValue" (dict "value" .Values.extraEnv "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_ENABLE_LDAP
|
||||
value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }}
|
||||
{{- if .Values.ldap.enabled }}
|
||||
- name: POSTGRESQL_LDAP_SERVER
|
||||
value: {{ .Values.ldap.server }}
|
||||
- name: POSTGRESQL_LDAP_PORT
|
||||
value: {{ .Values.ldap.port | quote }}
|
||||
- name: POSTGRESQL_LDAP_SCHEME
|
||||
value: {{ .Values.ldap.scheme }}
|
||||
{{- if .Values.ldap.tls }}
|
||||
- name: POSTGRESQL_LDAP_TLS
|
||||
value: "1"
|
||||
{{- end}}
|
||||
- name: POSTGRESQL_LDAP_PREFIX
|
||||
value: {{ .Values.ldap.prefix | quote }}
|
||||
- name: POSTGRESQL_LDAP_SUFFIX
|
||||
value: {{ .Values.ldap.suffix | quote}}
|
||||
- name: POSTGRESQL_LDAP_BASE_DN
|
||||
value: {{ .Values.ldap.baseDN }}
|
||||
- name: POSTGRESQL_LDAP_BIND_DN
|
||||
value: {{ .Values.ldap.bindDN }}
|
||||
{{- if (not (empty .Values.ldap.bind_password)) }}
|
||||
- name: POSTGRESQL_LDAP_BIND_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "postgresql.secretName" . }}
|
||||
key: postgresql-ldap-password
|
||||
{{- end}}
|
||||
- name: POSTGRESQL_LDAP_SEARCH_ATTR
|
||||
value: {{ .Values.ldap.search_attr }}
|
||||
- name: POSTGRESQL_LDAP_SEARCH_FILTER
|
||||
value: {{ .Values.ldap.search_filter }}
|
||||
- name: POSTGRESQL_LDAP_URL
|
||||
value: {{ .Values.ldap.url }}
|
||||
{{- end}}
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: {{ template "postgresql.port" . }}
|
||||
|
||||
@@ -192,6 +192,23 @@ postgresqlDataDir: /bitnami/postgresql/data
|
||||
##
|
||||
# terminationGracePeriodSeconds: 30
|
||||
|
||||
## LDAP configuration
|
||||
##
|
||||
ldap:
|
||||
enabled: false
|
||||
url: ""
|
||||
server: ""
|
||||
port: ""
|
||||
prefix: ""
|
||||
suffix: ""
|
||||
baseDN: ""
|
||||
bindDN: ""
|
||||
bind_password:
|
||||
search_attr: ""
|
||||
search_filter: ""
|
||||
scheme: ""
|
||||
tls: false
|
||||
|
||||
## PostgreSQL service configuration
|
||||
service:
|
||||
## PosgresSQL service type
|
||||
|
||||
@@ -192,6 +192,23 @@ postgresqlDataDir: /bitnami/postgresql/data
|
||||
##
|
||||
# terminationGracePeriodSeconds: 30
|
||||
|
||||
## LDAP configuration
|
||||
##
|
||||
ldap:
|
||||
enabled: false
|
||||
url: ""
|
||||
server: ""
|
||||
port: ""
|
||||
prefix: ""
|
||||
suffix: ""
|
||||
baseDN: ""
|
||||
bindDN: ""
|
||||
bind_password:
|
||||
search_attr: ""
|
||||
search_filter: ""
|
||||
scheme: ""
|
||||
tls: false
|
||||
|
||||
## PostgreSQL service configuration
|
||||
service:
|
||||
## PosgresSQL service type
|
||||
|
||||
Reference in New Issue
Block a user