From 903dbd40878897f144148db83afea906bf374176 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20R=C3=ADos=20Saavedra?= Date: Tue, 12 Nov 2019 16:38:07 +0100 Subject: [PATCH] [stable/postgresql] Add ldap support to postgresql chart (#18813) * Add ldap support for postgres chart Signed-off-by: Rafael Rios Saavedra * Adds validation to ldap configuration method. Fix minor details. Signed-off-by: Rafael Rios Saavedra * Bump minor version. Fix simultaneous ldap.url and ldap.server checking Signed-off-by: Rafael Rios Saavedra * Fix condition in ldap.url and ldap.server testing Signed-off-by: Rafael Rios Saavedra --- stable/postgresql/Chart.yaml | 2 +- stable/postgresql/README.md | 18 ++++++++++ stable/postgresql/templates/NOTES.txt | 2 ++ stable/postgresql/templates/_helpers.tpl | 26 +++++++++++++++ stable/postgresql/templates/secrets.yaml | 3 ++ stable/postgresql/templates/statefulset.yaml | 35 ++++++++++++++++++++ stable/postgresql/values-production.yaml | 17 ++++++++++ stable/postgresql/values.yaml | 17 ++++++++++ 8 files changed, 119 insertions(+), 1 deletion(-) diff --git a/stable/postgresql/Chart.yaml b/stable/postgresql/Chart.yaml index 493d648b72..009ef250fd 100644 --- a/stable/postgresql/Chart.yaml +++ b/stable/postgresql/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: postgresql -version: 7.0.2 +version: 7.1.0 appVersion: 11.5.0 description: Chart for PostgreSQL, an object-relational database management system (ORDBMS) with an emphasis on extensibility and on standards-compliance. keywords: diff --git a/stable/postgresql/README.md b/stable/postgresql/README.md index cc33d4bb56..59ecb0c083 100644 --- a/stable/postgresql/README.md +++ b/stable/postgresql/README.md @@ -70,6 +70,20 @@ The following tables lists the configurable parameters of the PostgreSQL chart a | `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | | `volumePermissions.securityContext.runAsUser` | User ID for the init container | `0` | | `usePasswordFile` | Have the secrets mounted as a file instead of env vars | `false` | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.existingSecret` | Name of existing secret to use for LDAP passwords | `nil` | +| `ldap.url` | LDAP URL beginning in the form `ldap[s]://host[:port]/basedn[?[attribute][?[scope][?[filter]]]]` | `nil` | +| `ldap.server` | IP address or name of the LDAP server. | `nil` | +| `ldap.port` | Port number on the LDAP server to connect to | `nil` | +| `ldap.scheme` | Set to `ldaps` to use LDAPS. | `nil` | +| `ldap.tls` | Set to `1` to use TLS encryption | `nil` | +| `ldap.prefix` | String to prepend to the user name when forming the DN to bind | `nil` | +| `ldap.suffix` | String to append to the user name when forming the DN to bind | `nil` | +| `ldap.search_attr` | Attribute to match agains the user name in the search | `nil` | +| `ldap.search_filter` | The search filter to use when doing search+bind authentication | `nil` | +| `ldap.baseDN` | Root DN to begin the search for the user in | `nil` | +| `ldap.bindDN` | DN of user to bind to LDAP | `nil` | +| `ldap.bind_password` | Password for the user to bind to LDAP | `nil` | | `replication.enabled` | Enable replication | `false` | | `replication.user` | Replication user | `repl_user` | | `replication.password` | Replication user password | `repl_password` | @@ -375,6 +389,10 @@ $ helm upgrade my-release bitnami/influxdb \ > Note: you need to substitute the placeholders _[POSTGRESQL_PASSWORD]_, and _[REPLICATION_PASSWORD]_ with the values obtained from instructions in the installation notes. +## 7.1.0 + +Adds support for LDAP configuration. + ## 7.0.0 Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec. diff --git a/stable/postgresql/templates/NOTES.txt b/stable/postgresql/templates/NOTES.txt index 798fa10cf0..0132a7d1bc 100644 --- a/stable/postgresql/templates/NOTES.txt +++ b/stable/postgresql/templates/NOTES.txt @@ -42,6 +42,8 @@ To connect to your database from outside the cluster execute the following comma {{- end }} +{{- include "postgresql.validateValues" . -}} + {{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. diff --git a/stable/postgresql/templates/_helpers.tpl b/stable/postgresql/templates/_helpers.tpl index b379f2913a..cf50989df0 100644 --- a/stable/postgresql/templates/_helpers.tpl +++ b/stable/postgresql/templates/_helpers.tpl @@ -372,3 +372,29 @@ Return the appropriate apiVersion for statefulset. {{- print "apps/v1" -}} {{- end -}} {{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "postgresql.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "postgresql.validateValues.ldapConfigurationMethod" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* +Validate values of Postgresql - If ldap.url is used then you don't need the other settings for ldap +*/}} +{{- define "postgresql.validateValues.ldapConfigurationMethod" -}} +{{- if and .Values.ldap.enabled (and (not (empty .Values.ldap.url)) (not (empty .Values.ldap.server))) }} +postgresql: ldap.url, ldap.server + You cannot set both `ldap.url` and `ldap.server` at the same time. + Please provide a unique way to configure LDAP. + More info at https://www.postgresql.org/docs/current/auth-ldap.html +{{- end -}} +{{- end -}} diff --git a/stable/postgresql/templates/secrets.yaml b/stable/postgresql/templates/secrets.yaml index e0bc3b2399..074e1ed296 100644 --- a/stable/postgresql/templates/secrets.yaml +++ b/stable/postgresql/templates/secrets.yaml @@ -14,4 +14,7 @@ data: {{- if .Values.replication.enabled }} postgresql-replication-password: {{ include "postgresql.replication.password" . | b64enc | quote }} {{- end }} + {{- if (and .Values.ldap.enabled .Values.ldap.bind_password)}} + postgresql-ldap-password: {{ .Values.ldap.bind_password | b64enc | quote }} + {{- end }} {{- end -}} diff --git a/stable/postgresql/templates/statefulset.yaml b/stable/postgresql/templates/statefulset.yaml index 64c297f559..1abddcf67b 100644 --- a/stable/postgresql/templates/statefulset.yaml +++ b/stable/postgresql/templates/statefulset.yaml @@ -174,6 +174,41 @@ spec: {{- if .Values.extraEnv }} {{- include "postgresql.tplValue" (dict "value" .Values.extraEnv "context" $) | nindent 12 }} {{- end }} + - name: POSTGRESQL_ENABLE_LDAP + value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }} + {{- if .Values.ldap.enabled }} + - name: POSTGRESQL_LDAP_SERVER + value: {{ .Values.ldap.server }} + - name: POSTGRESQL_LDAP_PORT + value: {{ .Values.ldap.port | quote }} + - name: POSTGRESQL_LDAP_SCHEME + value: {{ .Values.ldap.scheme }} + {{- if .Values.ldap.tls }} + - name: POSTGRESQL_LDAP_TLS + value: "1" + {{- end}} + - name: POSTGRESQL_LDAP_PREFIX + value: {{ .Values.ldap.prefix | quote }} + - name: POSTGRESQL_LDAP_SUFFIX + value: {{ .Values.ldap.suffix | quote}} + - name: POSTGRESQL_LDAP_BASE_DN + value: {{ .Values.ldap.baseDN }} + - name: POSTGRESQL_LDAP_BIND_DN + value: {{ .Values.ldap.bindDN }} + {{- if (not (empty .Values.ldap.bind_password)) }} + - name: POSTGRESQL_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.secretName" . }} + key: postgresql-ldap-password + {{- end}} + - name: POSTGRESQL_LDAP_SEARCH_ATTR + value: {{ .Values.ldap.search_attr }} + - name: POSTGRESQL_LDAP_SEARCH_FILTER + value: {{ .Values.ldap.search_filter }} + - name: POSTGRESQL_LDAP_URL + value: {{ .Values.ldap.url }} + {{- end}} ports: - name: postgresql containerPort: {{ template "postgresql.port" . }} diff --git a/stable/postgresql/values-production.yaml b/stable/postgresql/values-production.yaml index 353848a4fe..d9353db5e1 100644 --- a/stable/postgresql/values-production.yaml +++ b/stable/postgresql/values-production.yaml @@ -192,6 +192,23 @@ postgresqlDataDir: /bitnami/postgresql/data ## # terminationGracePeriodSeconds: 30 +## LDAP configuration +## +ldap: + enabled: false + url: "" + server: "" + port: "" + prefix: "" + suffix: "" + baseDN: "" + bindDN: "" + bind_password: + search_attr: "" + search_filter: "" + scheme: "" + tls: false + ## PostgreSQL service configuration service: ## PosgresSQL service type diff --git a/stable/postgresql/values.yaml b/stable/postgresql/values.yaml index e13d0a7769..60c8507663 100644 --- a/stable/postgresql/values.yaml +++ b/stable/postgresql/values.yaml @@ -192,6 +192,23 @@ postgresqlDataDir: /bitnami/postgresql/data ## # terminationGracePeriodSeconds: 30 +## LDAP configuration +## +ldap: + enabled: false + url: "" + server: "" + port: "" + prefix: "" + suffix: "" + baseDN: "" + bindDN: "" + bind_password: + search_attr: "" + search_filter: "" + scheme: "" + tls: false + ## PostgreSQL service configuration service: ## PosgresSQL service type