mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Added OpenLDAP chart (#2820)
* Added OpenLDAP chart * Rebased the code. Addressed review items and tried to bring the chart to be more consistent to other charts in the repo * Addressed review comments: - Reindented charts with 2 spaces for list items - Hard coded container port name to refer to it in the service - Added liveness and readiness probes - Changed chart label values to use the template * Moved the chart to stable, and addressed rest of the review feedback * Move to apps/v1beta2 * Fixed formatting of markdown table in README * Fixed default value in README * Auto-generate the passwords by default
This commit is contained in:
Enis Soztutar
committed by
k8s-ci-robot
k8s-ci-robot
parent
0e79b3de56
commit
a0dfbbd81a
@@ -0,0 +1,21 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
@@ -0,0 +1,15 @@
|
||||
name: openldap
|
||||
home: https://www.openldap.org
|
||||
version: 0.1.0
|
||||
appVersion: 2.4.44
|
||||
description: Community developed LDAP software
|
||||
icon: http://www.openldap.org/images/headers/LDAPworm.gif
|
||||
keywords:
|
||||
- ldap
|
||||
- openldap
|
||||
sources:
|
||||
- https://github.com/kubernetes/charts
|
||||
maintainers:
|
||||
- name: enis
|
||||
email: enis@apache.org
|
||||
engine: gotpl
|
||||
@@ -0,0 +1,80 @@
|
||||
# OpenLDAP Helm Chart
|
||||
|
||||
## Prerequisites Details
|
||||
* Kubernetes 1.8+
|
||||
* PV support on the underlying infrastructure
|
||||
|
||||
## Chart Details
|
||||
This chart will do the following:
|
||||
|
||||
* Instantiate an instance of OpenLDAP server
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```bash
|
||||
$ helm install --name my-release stable/openldap
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
We use the docker images provided by https://github.com/osixia/docker-openldap. The docker image is highly configurable and well documented. Please consult to documentation for the docker image for more information.
|
||||
|
||||
The following tables lists the configurable parameters of the openldap chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------- | ------------------------------------------------------------- | -------------------|
|
||||
| `replicas` | How many replicas to schedule | `1` |
|
||||
| `image.repository` | Container image repository | `osixia/openldap` |
|
||||
| `image.tag` | Container image tag | `1.1.10` |
|
||||
| `image.pullPolicy` | Container pull policy | `IfNotPresent` |
|
||||
| `containerName` | Name of the container in the Pod | `slapd` |
|
||||
| `service.type` | Service type | `ClusterIP` |
|
||||
| `service.ldapPort` | External service port for LDAP | `389` |
|
||||
| `service.sslLdapPort` | External service port for SSL+LDAP | `636` |
|
||||
| `env` | List of key value pairs as env variables to be sent to the docker image. See https://github.com/osixia/docker-openldap for available ones | `[see values.yaml]` |
|
||||
| `adminPassword` | Password for admin user. Unset to auto-generate the password | None |
|
||||
| `configPassword` | Password for config user. Unset to auto-generate the password | None |
|
||||
| `customLdifFiles` | Custom ldif files to seed the LDAP server. List of filename -> data pairs | None |
|
||||
| `persistence.enabled` | Whether to use PersistentVolumes or not | `false` |
|
||||
| `persistence.storageClass` | Storage class for PersistentVolumes. | `<unset>` |
|
||||
| `persistence.accessMode` | Access mode for PersistentVolumes | `ReadWriteOnce` |
|
||||
| `persistence.size` | PersistentVolumeClaim storage size | `8Gi` |
|
||||
| `resources` | Container resource requests and limits in yaml | `{}` |
|
||||
| `test.image.repository` | Test container image requires bats framework | `dduportal/bats` |
|
||||
| `test.image.tag` | Test container tag | `0.4.0` |
|
||||
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
|
||||
|
||||
```bash
|
||||
$ helm install --name my-release -f values.yaml stable/openldap
|
||||
```
|
||||
|
||||
> **Tip**: You can use the default [values.yaml](values.yaml)
|
||||
|
||||
|
||||
## Cleanup orphaned Persistent Volumes
|
||||
|
||||
Deleting the Deployment will not delete associated Persistent Volumes if persistence is enabled.
|
||||
|
||||
Do the following after deleting the chart release to clean up orphaned Persistent Volumes.
|
||||
|
||||
```bash
|
||||
$ kubectl delete pvc -l app=${RELEASE-NAME}-openldap
|
||||
```
|
||||
|
||||
## Testing
|
||||
|
||||
Helm tests are included and they confirm the first three cluster members have quorum.
|
||||
|
||||
```bash
|
||||
helm test <RELEASE_NAME>
|
||||
RUNNING: foolish-mouse-openldap-service-test-akmms
|
||||
PASSED: foolish-mouse-openldap-service-test-akmms
|
||||
```
|
||||
|
||||
It will confirm that we can do an ldapsearch with the default credentials
|
||||
@@ -0,0 +1,20 @@
|
||||
OpenLDAP has been installed. You can access the server from within the k8s cluster using:
|
||||
|
||||
{{ template "openldap.fullname" . }}-service.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }}
|
||||
|
||||
|
||||
You can access the LDAP adminPassword and configPassword using:
|
||||
|
||||
kubectl get secret --namespace {{ .Release.Namespace }} {{ template "openldap.fullname" . }}-secret -o jsonpath="{.data.LDAP_ADMIN_PASSWORD}" | base64 --decode; echo
|
||||
kubectl get secret --namespace {{ .Release.Namespace }} {{ template "openldap.fullname" . }}-secret -o jsonpath="{.data.LDAP_CONFIG_PASSWORD}" | base64 --decode; echo
|
||||
|
||||
|
||||
You can access the LDAP service, from within the cluster (or with kubectl port-forward) with a command like (replace password and domain):
|
||||
ldapsearch -x -H ldap://{{ template "openldap.fullname" . }}-service.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }} -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w $LDAP_ADMIN_PASSWORD
|
||||
|
||||
|
||||
Test server health using Helm test:
|
||||
helm test {{ .Release.Name }}
|
||||
|
||||
|
||||
You can also consider installing the helm chart for phpldapadmin to manage this instance of OpenLDAP, or install Apache Directory Studio, and connect using kubectl port-forward.
|
||||
@@ -0,0 +1,32 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "openldap.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "openldap.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "openldap.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,20 @@
|
||||
#
|
||||
# A ConfigMap spec for openldap slapd that map directly to files under
|
||||
# /container/service/slapd/assets/config/bootstrap/ldif/custom
|
||||
#
|
||||
{{- if .Values.customLdifFiles }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-customldif-configmap
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
{{- range $key, $val := .Values.customLdifFiles }}
|
||||
{{ $key }}: |-
|
||||
{{ $val | indent 4}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,85 @@
|
||||
apiVersion: apps/v1beta2
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ .Values.containerName | quote }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
ports:
|
||||
- name: ldap-port
|
||||
containerPort: 389
|
||||
- name: ssl-ldap-port
|
||||
containerPort: 636
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ template "openldap.fullname" . }}-env-configmap
|
||||
- secretRef:
|
||||
name: {{ template "openldap.fullname" . }}-secret
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/ldap
|
||||
subPath: data
|
||||
- name: data
|
||||
mountPath: /etc/ldap/slapd.d
|
||||
subPath: config-data
|
||||
{{- if .Values.customLdifFiles }}
|
||||
- name: customldif
|
||||
mountPath: /container/service/slapd/assets/config/bootstrap/ldif/custom
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: ldap-port
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
failureThreshold: 10
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: ldap-port
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
failureThreshold: 10
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.customLdifFiles }}
|
||||
- name: customldif
|
||||
configMap:
|
||||
name: {{ template "openldap.fullname" . }}-customldif-configmap
|
||||
{{- end }}
|
||||
- name: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.existingClaim | default (include "openldap.fullname" .) }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,17 @@
|
||||
#
|
||||
# A ConfigMap spec for openldap slapd that map directly to env variables in the Pod.
|
||||
# List of environment variables supported is from the docker image:
|
||||
# https://github.com/osixia/docker-openldap#beginner-guide
|
||||
# Note that passwords are defined as secrets
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-env-configmap
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
{{ toYaml .Values.env | indent 2 }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode | quote }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.persistence.storageClass }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-secret
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
type: Opaque
|
||||
data:
|
||||
LDAP_ADMIN_PASSWORD: {{ .Values.adminPassword | default (randAlphaNum 32) | b64enc | quote }}
|
||||
LDAP_CONFIG_PASSWORD: {{ .Values.configPassword | default (randAlphaNum 32) | b64enc | quote }}
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-service
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
type: {{ .Values.service.type | quote }}
|
||||
selector:
|
||||
app: {{ template "openldap.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
ports:
|
||||
- name: ldap-port
|
||||
protocol: TCP
|
||||
port: {{ .Values.service.ldapPort }}
|
||||
targetPort: ldap-port
|
||||
- name: ssl-ldap-port
|
||||
protocol: TCP
|
||||
port: {{ .Values.service.sslLdapPort }}
|
||||
targetPort: ssl-ldap-port
|
||||
@@ -0,0 +1,45 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ template "openldap.fullname" . }}-test-{{ randAlphaNum 5 | lower }}"
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
initContainers:
|
||||
- name: test-framework
|
||||
image: {{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}
|
||||
command:
|
||||
- "bash"
|
||||
- "-c"
|
||||
- |
|
||||
set -ex
|
||||
# copy bats to tools dir
|
||||
cp -R /usr/local/libexec/ /tools/bats/
|
||||
volumeMounts:
|
||||
- mountPath: /tools
|
||||
name: tools
|
||||
containers:
|
||||
- name: {{ .Release.Name }}-test
|
||||
image: {{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ template "openldap.fullname" . }}-secret
|
||||
command: ["/tools/bats/bats", "-t", "/tests/run.sh"]
|
||||
volumeMounts:
|
||||
- mountPath: /tests
|
||||
name: tests
|
||||
readOnly: true
|
||||
- mountPath: /tools
|
||||
name: tools
|
||||
volumes:
|
||||
- name: tests
|
||||
configMap:
|
||||
name: {{ template "openldap.fullname" . }}-tests
|
||||
- name: tools
|
||||
emptyDir: {}
|
||||
restartPolicy: Never
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "openldap.fullname" . }}-tests
|
||||
labels:
|
||||
app: {{ template "openldap.name" . }}
|
||||
chart: {{ template "openldap.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
run.sh: |-
|
||||
@test "Testing connecting to slapd server" {
|
||||
# Ideally, this should be in the docker image, but there is not a generic image we can use
|
||||
# with bats and ldap-utils installed. It is not worth for now to push an image for this.
|
||||
apt-get update && apt-get install -y ldap-utils
|
||||
ldapsearch -x -H ldap://{{ template "openldap.fullname" . }}-service.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }} -b "dc=example,dc=org" -D "cn=admin,dc=example,dc=org" -w $LDAP_ADMIN_PASSWORD
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
# Default values for openldap.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
replicas: 1
|
||||
image:
|
||||
# From repository https://github.com/osixia/docker-openldap
|
||||
repository: osixia/openldap
|
||||
tag: 1.2.0
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
containerName: slapd
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
ldapPort: 389
|
||||
sslLdapPort: 636
|
||||
|
||||
# Default configuration for openldap as environment variables. These get injected directly in the container.
|
||||
# Use the env variables from https://github.com/osixia/docker-openldap#beginner-guide
|
||||
env:
|
||||
LDAP_ORGANISATION: "Example Inc."
|
||||
LDAP_DOMAIN: "example.org"
|
||||
LDAP_BACKEND: "hdb"
|
||||
LDAP_TLS: "true"
|
||||
LDAP_TLS_ENFORCE: "false"
|
||||
LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
|
||||
|
||||
# Default Passwords to use, stored as a secret. If unset, passwords are auto-generated.
|
||||
# You can override these at install time with
|
||||
# helm install openldap --set openldap.adminPassword=<passwd>,openldap.configPassword=<passwd>
|
||||
# adminPassword: admin
|
||||
# configPassword: config
|
||||
|
||||
# Custom openldap configuration files used to override default settings
|
||||
customLdifFiles:
|
||||
# 01-default-users.ldif: |-
|
||||
# Predefine users here
|
||||
|
||||
## Persist data to a persitent volume
|
||||
persistence:
|
||||
enabled: false
|
||||
## database data Persistent Volume Storage Class
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
# storageClass: "-"
|
||||
accessMode: ReadWriteOnce
|
||||
size: 8Gi
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: "100m"
|
||||
# memory: "256Mi"
|
||||
# limits:
|
||||
# cpu: "500m"
|
||||
# memory: "512Mi"
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
## test container details
|
||||
test:
|
||||
image:
|
||||
repository: dduportal/bats
|
||||
tag: 0.4.0
|
||||
Reference in New Issue
Block a user