diff --git a/stable/openldap/.helmignore b/stable/openldap/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/stable/openldap/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/stable/openldap/Chart.yaml b/stable/openldap/Chart.yaml new file mode 100644 index 0000000000..db6af1ab30 --- /dev/null +++ b/stable/openldap/Chart.yaml @@ -0,0 +1,15 @@ +name: openldap +home: https://www.openldap.org +version: 0.1.0 +appVersion: 2.4.44 +description: Community developed LDAP software +icon: http://www.openldap.org/images/headers/LDAPworm.gif +keywords: + - ldap + - openldap +sources: + - https://github.com/kubernetes/charts +maintainers: + - name: enis + email: enis@apache.org +engine: gotpl diff --git a/stable/openldap/README.md b/stable/openldap/README.md new file mode 100644 index 0000000000..f49669aa9a --- /dev/null +++ b/stable/openldap/README.md @@ -0,0 +1,80 @@ +# OpenLDAP Helm Chart + +## Prerequisites Details +* Kubernetes 1.8+ +* PV support on the underlying infrastructure + +## Chart Details +This chart will do the following: + +* Instantiate an instance of OpenLDAP server + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```bash +$ helm install --name my-release stable/openldap +``` + +## Configuration + +We use the docker images provided by https://github.com/osixia/docker-openldap. The docker image is highly configurable and well documented. Please consult to documentation for the docker image for more information. + +The following tables lists the configurable parameters of the openldap chart and their default values. + +| Parameter | Description | Default | +| ------------------------------- | ------------------------------------------------------------- | -------------------| +| `replicas` | How many replicas to schedule | `1` | +| `image.repository` | Container image repository | `osixia/openldap` | +| `image.tag` | Container image tag | `1.1.10` | +| `image.pullPolicy` | Container pull policy | `IfNotPresent` | +| `containerName` | Name of the container in the Pod | `slapd` | +| `service.type` | Service type | `ClusterIP` | +| `service.ldapPort` | External service port for LDAP | `389` | +| `service.sslLdapPort` | External service port for SSL+LDAP | `636` | +| `env` | List of key value pairs as env variables to be sent to the docker image. See https://github.com/osixia/docker-openldap for available ones | `[see values.yaml]` | +| `adminPassword` | Password for admin user. Unset to auto-generate the password | None | +| `configPassword` | Password for config user. Unset to auto-generate the password | None | +| `customLdifFiles` | Custom ldif files to seed the LDAP server. List of filename -> data pairs | None | +| `persistence.enabled` | Whether to use PersistentVolumes or not | `false` | +| `persistence.storageClass` | Storage class for PersistentVolumes. | `` | +| `persistence.accessMode` | Access mode for PersistentVolumes | `ReadWriteOnce` | +| `persistence.size` | PersistentVolumeClaim storage size | `8Gi` | +| `resources` | Container resource requests and limits in yaml | `{}` | +| `test.image.repository` | Test container image requires bats framework | `dduportal/bats` | +| `test.image.tag` | Test container tag | `0.4.0` | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```bash +$ helm install --name my-release -f values.yaml stable/openldap +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + + +## Cleanup orphaned Persistent Volumes + +Deleting the Deployment will not delete associated Persistent Volumes if persistence is enabled. + +Do the following after deleting the chart release to clean up orphaned Persistent Volumes. + +```bash +$ kubectl delete pvc -l app=${RELEASE-NAME}-openldap +``` + +## Testing + +Helm tests are included and they confirm the first three cluster members have quorum. + +```bash +helm test +RUNNING: foolish-mouse-openldap-service-test-akmms +PASSED: foolish-mouse-openldap-service-test-akmms +``` + +It will confirm that we can do an ldapsearch with the default credentials diff --git a/stable/openldap/templates/NOTES.txt b/stable/openldap/templates/NOTES.txt new file mode 100644 index 0000000000..f6d00fa307 --- /dev/null +++ b/stable/openldap/templates/NOTES.txt @@ -0,0 +1,20 @@ +OpenLDAP has been installed. You can access the server from within the k8s cluster using: + + {{ template "openldap.fullname" . }}-service.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }} + + +You can access the LDAP adminPassword and configPassword using: + + kubectl get secret --namespace {{ .Release.Namespace }} {{ template "openldap.fullname" . }}-secret -o jsonpath="{.data.LDAP_ADMIN_PASSWORD}" | base64 --decode; echo + kubectl get secret --namespace {{ .Release.Namespace }} {{ template "openldap.fullname" . }}-secret -o jsonpath="{.data.LDAP_CONFIG_PASSWORD}" | base64 --decode; echo + + +You can access the LDAP service, from within the cluster (or with kubectl port-forward) with a command like (replace password and domain): + ldapsearch -x -H ldap://{{ template "openldap.fullname" . }}-service.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }} -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w $LDAP_ADMIN_PASSWORD + + +Test server health using Helm test: + helm test {{ .Release.Name }} + + +You can also consider installing the helm chart for phpldapadmin to manage this instance of OpenLDAP, or install Apache Directory Studio, and connect using kubectl port-forward. diff --git a/stable/openldap/templates/_helpers.tpl b/stable/openldap/templates/_helpers.tpl new file mode 100644 index 0000000000..7d6b3aa51b --- /dev/null +++ b/stable/openldap/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "openldap.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "openldap.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "openldap.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/stable/openldap/templates/openldap-customldif-configmap.yaml b/stable/openldap/templates/openldap-customldif-configmap.yaml new file mode 100644 index 0000000000..ab6b746080 --- /dev/null +++ b/stable/openldap/templates/openldap-customldif-configmap.yaml @@ -0,0 +1,20 @@ +# +# A ConfigMap spec for openldap slapd that map directly to files under +# /container/service/slapd/assets/config/bootstrap/ldif/custom +# +{{- if .Values.customLdifFiles }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "openldap.fullname" . }}-customldif-configmap + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: +{{- range $key, $val := .Values.customLdifFiles }} + {{ $key }}: |- +{{ $val | indent 4}} +{{- end }} +{{- end -}} diff --git a/stable/openldap/templates/openldap-deployment.yaml b/stable/openldap/templates/openldap-deployment.yaml new file mode 100644 index 0000000000..33da090254 --- /dev/null +++ b/stable/openldap/templates/openldap-deployment.yaml @@ -0,0 +1,85 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: {{ template "openldap.fullname" . }} + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicas }} + selector: + matchLabels: + app: {{ template "openldap.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "openldap.name" . }} + release: {{ .Release.Name }} + spec: + containers: + - name: {{ .Values.containerName | quote }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + ports: + - name: ldap-port + containerPort: 389 + - name: ssl-ldap-port + containerPort: 636 + envFrom: + - configMapRef: + name: {{ template "openldap.fullname" . }}-env-configmap + - secretRef: + name: {{ template "openldap.fullname" . }}-secret + volumeMounts: + - name: data + mountPath: /var/lib/ldap + subPath: data + - name: data + mountPath: /etc/ldap/slapd.d + subPath: config-data + {{- if .Values.customLdifFiles }} + - name: customldif + mountPath: /container/service/slapd/assets/config/bootstrap/ldif/custom + {{- end }} + livenessProbe: + tcpSocket: + port: ldap-port + initialDelaySeconds: 20 + periodSeconds: 10 + failureThreshold: 10 + readinessProbe: + tcpSocket: + port: ldap-port + initialDelaySeconds: 20 + periodSeconds: 10 + failureThreshold: 10 + resources: +{{ toYaml .Values.resources | indent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + volumes: + {{- if .Values.customLdifFiles }} + - name: customldif + configMap: + name: {{ template "openldap.fullname" . }}-customldif-configmap + {{- end }} + - name: data + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim | default (include "openldap.fullname" .) }} + {{- else }} + emptyDir: {} + {{- end -}} diff --git a/stable/openldap/templates/openldap-env-configmap.yaml b/stable/openldap/templates/openldap-env-configmap.yaml new file mode 100644 index 0000000000..cea65e558a --- /dev/null +++ b/stable/openldap/templates/openldap-env-configmap.yaml @@ -0,0 +1,17 @@ +# +# A ConfigMap spec for openldap slapd that map directly to env variables in the Pod. +# List of environment variables supported is from the docker image: +# https://github.com/osixia/docker-openldap#beginner-guide +# Note that passwords are defined as secrets +# +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "openldap.fullname" . }}-env-configmap + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: +{{ toYaml .Values.env | indent 2 }} diff --git a/stable/openldap/templates/openldap-pvc.yaml b/stable/openldap/templates/openldap-pvc.yaml new file mode 100644 index 0000000000..443994ba1f --- /dev/null +++ b/stable/openldap/templates/openldap-pvc.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ template "openldap.fullname" . }} + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} +{{- if .Values.persistence.storageClass }} +{{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" +{{- else }} + storageClassName: "{{ .Values.persistence.storageClass }}" +{{- end }} +{{- end }} +{{- end }} diff --git a/stable/openldap/templates/openldap-secret.yaml b/stable/openldap/templates/openldap-secret.yaml new file mode 100644 index 0000000000..6e4946fe75 --- /dev/null +++ b/stable/openldap/templates/openldap-secret.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "openldap.fullname" . }}-secret + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +type: Opaque +data: + LDAP_ADMIN_PASSWORD: {{ .Values.adminPassword | default (randAlphaNum 32) | b64enc | quote }} + LDAP_CONFIG_PASSWORD: {{ .Values.configPassword | default (randAlphaNum 32) | b64enc | quote }} diff --git a/stable/openldap/templates/openldap-service.yaml b/stable/openldap/templates/openldap-service.yaml new file mode 100644 index 0000000000..9adc0e66af --- /dev/null +++ b/stable/openldap/templates/openldap-service.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "openldap.fullname" . }}-service + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type | quote }} + selector: + app: {{ template "openldap.name" . }} + release: {{ .Release.Name }} + ports: + - name: ldap-port + protocol: TCP + port: {{ .Values.service.ldapPort }} + targetPort: ldap-port + - name: ssl-ldap-port + protocol: TCP + port: {{ .Values.service.sslLdapPort }} + targetPort: ssl-ldap-port \ No newline at end of file diff --git a/stable/openldap/templates/tests/openldap-test-runner.yaml b/stable/openldap/templates/tests/openldap-test-runner.yaml new file mode 100644 index 0000000000..bfde854b2a --- /dev/null +++ b/stable/openldap/templates/tests/openldap-test-runner.yaml @@ -0,0 +1,45 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ template "openldap.fullname" . }}-test-{{ randAlphaNum 5 | lower }}" + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + "helm.sh/hook": test-success +spec: + initContainers: + - name: test-framework + image: {{ .Values.test.image.repository }}:{{ .Values.test.image.tag }} + command: + - "bash" + - "-c" + - | + set -ex + # copy bats to tools dir + cp -R /usr/local/libexec/ /tools/bats/ + volumeMounts: + - mountPath: /tools + name: tools + containers: + - name: {{ .Release.Name }}-test + image: {{ .Values.test.image.repository }}:{{ .Values.test.image.tag }} + envFrom: + - secretRef: + name: {{ template "openldap.fullname" . }}-secret + command: ["/tools/bats/bats", "-t", "/tests/run.sh"] + volumeMounts: + - mountPath: /tests + name: tests + readOnly: true + - mountPath: /tools + name: tools + volumes: + - name: tests + configMap: + name: {{ template "openldap.fullname" . }}-tests + - name: tools + emptyDir: {} + restartPolicy: Never diff --git a/stable/openldap/templates/tests/openldap-tests.yaml b/stable/openldap/templates/tests/openldap-tests.yaml new file mode 100644 index 0000000000..8a66da4b8c --- /dev/null +++ b/stable/openldap/templates/tests/openldap-tests.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "openldap.fullname" . }}-tests + labels: + app: {{ template "openldap.name" . }} + chart: {{ template "openldap.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + run.sh: |- + @test "Testing connecting to slapd server" { + # Ideally, this should be in the docker image, but there is not a generic image we can use + # with bats and ldap-utils installed. It is not worth for now to push an image for this. + apt-get update && apt-get install -y ldap-utils + ldapsearch -x -H ldap://{{ template "openldap.fullname" . }}-service.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ldapPort }} -b "dc=example,dc=org" -D "cn=admin,dc=example,dc=org" -w $LDAP_ADMIN_PASSWORD + } diff --git a/stable/openldap/values.yaml b/stable/openldap/values.yaml new file mode 100644 index 0000000000..d506c2290d --- /dev/null +++ b/stable/openldap/values.yaml @@ -0,0 +1,72 @@ +# Default values for openldap. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicas: 1 +image: + # From repository https://github.com/osixia/docker-openldap + repository: osixia/openldap + tag: 1.2.0 + pullPolicy: IfNotPresent + +containerName: slapd + +service: + type: ClusterIP + ldapPort: 389 + sslLdapPort: 636 + +# Default configuration for openldap as environment variables. These get injected directly in the container. +# Use the env variables from https://github.com/osixia/docker-openldap#beginner-guide +env: + LDAP_ORGANISATION: "Example Inc." + LDAP_DOMAIN: "example.org" + LDAP_BACKEND: "hdb" + LDAP_TLS: "true" + LDAP_TLS_ENFORCE: "false" + LDAP_REMOVE_CONFIG_AFTER_SETUP: "true" + +# Default Passwords to use, stored as a secret. If unset, passwords are auto-generated. +# You can override these at install time with +# helm install openldap --set openldap.adminPassword=,openldap.configPassword= +# adminPassword: admin +# configPassword: config + +# Custom openldap configuration files used to override default settings +customLdifFiles: + # 01-default-users.ldif: |- + # Predefine users here + +## Persist data to a persitent volume +persistence: + enabled: false + ## database data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessMode: ReadWriteOnce + size: 8Gi + +resources: {} + # requests: + # cpu: "100m" + # memory: "256Mi" + # limits: + # cpu: "500m" + # memory: "512Mi" + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +## test container details +test: + image: + repository: dduportal/bats + tag: 0.4.0