Skip to content
This repository was archived by the owner on Feb 16, 2024. It is now read-only.

Commit 197ca46

Browse files
author
Felix Hennig
committed
Add OpenLDAP stacks (#195)
## Description Part of: stackabletech/documentation#300 This PR adds two new stacks: - A `tutorial-openldap` stack that sets up an OpenLDAP instance with TLS but without an AuthenticationClass - A `openldap` stack that also installs the AuthenticationClass so it can easily be installed and reused elsewhere
1 parent c7d68c5 commit 197ca46

File tree

3 files changed

+163
-0
lines changed

3 files changed

+163
-0
lines changed

‎stacks/authentication/openldap-tls-authenticationclass.yaml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
apiVersion: authentication.stackable.tech/v1alpha1
3+
kind: AuthenticationClass
4+
metadata:
5+
name: openldap
6+
spec:
7+
provider:
8+
ldap:
9+
hostname: openldap.default.svc.cluster.local
10+
searchBase: ou=users,dc=example,dc=org
11+
# The bind credentials are used so an application can bind to the LDAP server
12+
bindCredentials:
13+
secretClass: ldap-bind-credentials
14+
port: 1636
15+
tls:
16+
verification:
17+
server:
18+
caCert:
19+
secretClass: openldap-tls
20+
21+
---
22+
apiVersion: secrets.stackable.tech/v1alpha1
23+
kind: SecretClass
24+
metadata:
25+
name: openldap-bind-credentials
26+
spec:
27+
backend:
28+
k8sSearch:
29+
searchNamespace:
30+
pod: {}
31+
32+
---
33+
apiVersion: v1
34+
kind: Secret
35+
metadata:
36+
name: openldap-bind-credentials
37+
labels:
38+
secrets.stackable.tech/class: openldap-bind-credentials
39+
stringData:
40+
# User and password are defined in the OpenLDAP StatefulSet
41+
user: cn=ldapadmin,dc=example,dc=org
42+
password: ldapadminpassword

‎stacks/authentication/openldap-tls.yaml

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
apiVersion: secrets.stackable.tech/v1alpha1
3+
kind: SecretClass
4+
metadata:
5+
name: openldap-tls
6+
spec:
7+
backend:
8+
autoTls:
9+
ca:
10+
autoGenerate: true
11+
secret:
12+
name: openldap-tls-ca
13+
namespace: default
14+
---
15+
apiVersion: apps/v1
16+
kind: StatefulSet
17+
metadata:
18+
name: openldap
19+
labels:
20+
app.kubernetes.io/name: openldap
21+
spec:
22+
selector:
23+
matchLabels:
24+
app.kubernetes.io/name: openldap
25+
serviceName: openldap
26+
replicas: 1
27+
template:
28+
metadata:
29+
labels:
30+
app.kubernetes.io/name: openldap
31+
spec:
32+
containers:
33+
- name: openldap
34+
image: docker.io/bitnami/openldap:2.6
35+
env:
36+
# The Admin credentials. These are used to bind later.
37+
- name: LDAP_ADMIN_USERNAME
38+
value: ldapadmin
39+
- name: LDAP_ADMIN_PASSWORD
40+
value: ldapadminpassword
41+
# Regular users to create
42+
- name: LDAP_USERS
43+
value: alice,bob
44+
- name: LDAP_PASSWORDS
45+
value: alice,bob
46+
# Disallow anonymous binding
47+
- name: LDAP_ALLOW_ANON_BINDING
48+
value: "no"
49+
# TLD config
50+
- name: LDAP_ENABLE_TLS
51+
value: "yes"
52+
- name: LDAP_TLS_CERT_FILE
53+
value: /tls/tls.crt
54+
- name: LDAP_TLS_KEY_FILE
55+
value: /tls/tls.key
56+
- name: LDAP_TLS_CA_FILE
57+
value: /tls/ca.crt
58+
ports:
59+
- name: ldap
60+
containerPort: 1389
61+
- name: tls-ldap
62+
containerPort: 1636
63+
volumeMounts:
64+
- name: tls
65+
mountPath: /tls
66+
startupProbe:
67+
tcpSocket:
68+
port: 1389
69+
readinessProbe:
70+
tcpSocket:
71+
port: 1389
72+
volumes:
73+
- name: tls
74+
csi:
75+
driver: secrets.stackable.tech
76+
volumeAttributes:
77+
secrets.stackable.tech/class: openldap-tls
78+
secrets.stackable.tech/scope: pod
79+
---
80+
apiVersion: v1
81+
kind: Service
82+
metadata:
83+
name: openldap
84+
labels:
85+
app.kubernetes.io/name: openldap
86+
spec:
87+
type: ClusterIP
88+
ports:
89+
- name: ldap
90+
port: 1389
91+
targetPort: ldap
92+
- name: tls-ldap
93+
port: 1636
94+
targetPort: tls-ldap
95+
selector:
96+
app.kubernetes.io/name: openldap

‎stacks/stacks-v1.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -554,3 +554,28 @@ stacks:
554554
- helmChart: *template-opensearch-dashboards
555555
- helmChart: *template-vector-aggregator
556556
- plainYaml: https://raw.githubusercontent.com/stackabletech/stackablectl/main/stacks/logging/vector-aggregator-discovery.yaml
557+
tutorial-openldap:
558+
description: >-
559+
An OpenLDAP instance with two users (alice:alice, bob:bob) and TLS enabled.
560+
The bind user credentials are: ldapadmin:ldapadminpassword.
561+
No AuthenticationClass is configured, The AuthenticationClass is created manually in the tutorial.
562+
Use the 'openldap' Stack for an OpenLDAD with an AuthenticationClass already installed.
563+
stackableRelease: 22.11
564+
labels:
565+
- authentication
566+
- ldap
567+
manifests:
568+
- plainYaml: https://raw.githubusercontent.com/stackabletech/stackablectl/main/stacks/authentication/openldap-tls.yaml
569+
openldap:
570+
description: >-
571+
An OpenLDAP instance with two users (alice:alice, bob:bob) and TLS enabled.
572+
The bind user credentials are: ldapadmin:ldapadminpassword.
573+
The LDAP AuthenticationClass is called 'ldap' and the SecretClass for the bind credentials is called 'ldap-bind-credentials'.
574+
The stack already creates an appropriate Secret, so referring to the 'ldap' AuthenticationClass in your ProductCluster should be enough.
575+
stackableRelease: 22.11
576+
labels:
577+
- authentication
578+
- ldap
579+
manifests:
580+
- plainYaml: https://raw.githubusercontent.com/stackabletech/stackablectl/main/stacks/authentication/openldap-tls.yaml
581+
- plainYaml: https://raw.githubusercontent.com/stackabletech/stackablectl/main/stacks/authentication/openldap-tls-authenticationclass.yaml

0 commit comments

Comments
 (0)