OpenLDAP Helm Chart

Prerequisites Details

• Kubernetes 1.8+
• PV support on the underlying infrastructure

Chart Details

This chart will do the following:

• Instantiate 3 instances of OpenLDAP server with multi-master replication
• A phpldapadmin to administrate the OpenLDAP server
• ltb-passwd for self service password

TL;DR

To install the chart with the release name my-release:

$ helm repo add helm-openldap https://jp-gouin.github.io/helm-openldap/
$ helm install my-release helm-openldap/openldap-stack-ha

Configuration

We use the docker images provided by https://github.com/osixia/docker-openldap. The docker image is highly configurable and well documented. Please consult to documentation for the docker image for more information.

The following table lists the configurable parameters of the openldap chart and their default values.

Global section

Global parameters to configure the deployment of the application.

Application parameters

Parameters related to the configuration of the application.

Phpladadmin configuration

Parameters related to PHPLdapAdmin

Self-service password configuration

Parameters related to Self-service password.

Kubernetes parameters

Parameters related to Kubernetes.

Specify each parameter using the --set key=value[,key=value] argument to helm install.

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,

$ helm install --name my-release -f values.yaml stable/openldap

Tip: You can use the default values.yaml

PhpLdapAdmin

To enable PhpLdapAdmin set phpldapadmin.enabled to true

Ingress can be configure if you want to expose the service. Setup the env part of the configuration to access the OpenLdap server

Note : The ldap host should match the following namespace.Appfullname

Example :

phpldapadmin:
  enabled: true
  ingress:
    enabled: true
    annotations: {}
    path: /
    ## Ingress Host
    hosts:
    - phpldapadmin.local
  env:
    PHPLDAPADMIN_LDAP_CLIENT_TLS_REQCERT: "never"
     

Self-service-password

To enable Self-service-password set ltb-passwd.enabled to true

Ingress can be configure if you want to expose the service.

Setup the ldap part with the information of the OpenLdap server.

Set bindDN accordingly to your ldap domain

Note : The ldap server host should match the following ldap://namespace.Appfullname

Example :

ltb-passwd:
  enabled : true
  ingress:
    enabled: true
    annotations: {}
    host: "ssl-ldap2.local"

Cleanup orphaned Persistent Volumes

Deleting the Deployment will not delete associated Persistent Volumes if persistence is enabled.

Do the following after deleting the chart release to clean up orphaned Persistent Volumes.

$ kubectl delete pvc -l release=${RELEASE-NAME}

Custom Secret

existingSecret can be used to override the default secret.yaml provided

Troubleshoot

You can increase the level of log using 'logLevel'

# Set the container log level
# Valid log levels: none, error, warning, info (default), debug, trace
logLevel: info

Boostrap custom ldif

Warning when using custom ldif in the customLdifFiles: section you do not have to and shouldn't create the high level object organization or the admin user such as :

dn: dc=test,dc=example
dc: test
o: Example Inc.
objectclass: top
objectclass: dcObject
objectclass: organization

dn: cn=admin,dc=test,dc=example
cn: admin
description: LDAP administrator
objectclass: simpleSecurityObject
objectclass: organizationalRole
objectclass: top
userpassword: foo

This will result with the following error :

***  ERROR  | 2021-11-21 08:53:38 | /container/run/startup/slapd failed with status 68
Already exist

And the rest of your custom file will be skipped.

All internal configuration like cn=config , cn=module{0},cn=config should be avoided as well.

Changelog/Updating

To 3.0.0

This major update of the chart enable new feature for the deployment such as :

• supporting initcontainer
• supporting sidecar
• use global parameters to ease the configuration of the app
• out of the box integration with phpldapadmin and self-service password in a secure way