demos/stacks/authentication/openldap-tls.yaml at c9e8760c8a92fda07ad4685e0c19e8e7861cae3d · stackabletech/demos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
---
apiVersion: secrets.stackable.tech/v1alpha1
kind: SecretClass
metadata:
  name: openldap-tls
spec:
  backend:
    autoTls:
      ca:
        autoGenerate: true
        secret:
          name: openldap-tls-ca
          namespace: default
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: openldap
  labels:
    app.kubernetes.io/name: openldap
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: openldap
  serviceName: openldap
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: openldap
    spec:
      containers:
        - name: openldap
          image: docker.io/bitnamilegacy/openldap:2.6
          env:
            # The Admin credentials. These are used to bind later.
            - name: LDAP_ADMIN_USERNAME
              value: ldapadmin
            - name: LDAP_ADMIN_PASSWORD
              value: ldapadminpassword
            # Regular users to create
            - name: LDAP_USERS
              value: alice,bob
            - name: LDAP_PASSWORDS
              value: alice,bob
            # Disallow anonymous binding
            - name: LDAP_ALLOW_ANON_BINDING
              value: "no"
            # TLD config
            - name: LDAP_ENABLE_TLS
              value: "yes"
            - name: LDAP_TLS_CERT_FILE
              value: /tls/tls.crt
            - name: LDAP_TLS_KEY_FILE
              value: /tls/tls.key
            - name: LDAP_TLS_CA_FILE
              value: /tls/ca.crt
          ports:
            - name: ldap
              containerPort: 1389
            - name: tls-ldap
              containerPort: 1636
          volumeMounts:
            - name: tls
              mountPath: /tls
          startupProbe:
            tcpSocket:
              port: 1389
          readinessProbe:
            tcpSocket:
              port: 1389
      volumes:
        - name: tls
          csi:
            driver: secrets.stackable.tech
            volumeAttributes:
              secrets.stackable.tech/class: openldap-tls
              secrets.stackable.tech/scope: pod
---
apiVersion: v1
kind: Service
metadata:
  name: openldap
  labels:
    app.kubernetes.io/name: openldap
spec:
  type: ClusterIP
  ports:
    - name: ldap
      port: 1389
      targetPort: ldap
    - name: tls-ldap
      port: 1636
      targetPort: tls-ldap
  selector:
    app.kubernetes.io/name: openldap