superset-operator/examples/superset-with-ldap.yaml at 58dbe107009e94de4a18c686aef533c3f51d19c8 · stackabletech/superset-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
# helm install secret-operator oci://oci.stackable.tech/sdp-charts/secret-operator
# helm install commons-operator oci://oci.stackable.tech/sdp-charts/commons-operator
# helm install --set auth.username=superset --set auth.password=superset --set auth.database=superset --set image.repository=bitnamilegacy/postgresql --set volumePermissions.image.repository=bitnamilegacy/os-shell --set metrics.image.repository=bitnamilegacy/postgres-exporter --set global.security.allowInsecureImages=true superset-postgresql oci://registry-1.docker.io/bitnamicharts/postgresql

# Log in with user01/user01 or user02/user02
---
apiVersion: secrets.stackable.tech/v1alpha1
kind: SecretClass
metadata:
  name: openldap-tls
spec:
  backend:
    autoTls:
      ca:
        autoGenerate: true
        secret:
          name: openldap-tls-ca
          namespace: default
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: openldap
  labels:
    app.kubernetes.io/name: openldap
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: openldap
  serviceName: openldap
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: openldap
    spec:
      containers:
        - name: openldap
          image: docker.io/bitnamilegacy/openldap:2.5
          env:
            - name: LDAP_ADMIN_USERNAME
              value: admin
            - name: LDAP_ADMIN_PASSWORD
              value: admin
            - name: LDAP_USERS
              value: user01,user02
            - name: LDAP_PASSWORDS
              value: user01,user02
            - name: LDAP_ENABLE_TLS
              value: "yes"
            - name: LDAP_TLS_CERT_FILE
              value: /tls/tls.crt
            - name: LDAP_TLS_KEY_FILE
              value: /tls/tls.key
            - name: LDAP_TLS_CA_FILE
              value: /tls/ca.crt
          ports:
            # - name: ldap
            #   containerPort: 1389
            - name: tls-ldap
              containerPort: 1636
          volumeMounts:
            - name: tls
              mountPath: /tls
      volumes:
        - name: tls
          csi:
            driver: secrets.stackable.tech
            volumeAttributes:
              secrets.stackable.tech/class: openldap-tls
              secrets.stackable.tech/scope: pod
---
apiVersion: v1
kind: Service
metadata:
  name: openldap
  labels:
    app.kubernetes.io/name: openldap
spec:
  type: ClusterIP
  ports:
    # - name: ldap
    #   port: 389
    #   targetPort: ldap
    - name: tls-ldap
      port: 636
      targetPort: tls-ldap
  selector:
    app.kubernetes.io/name: openldap
---
apiVersion: v1
kind: Secret
metadata:
  name: superset-with-ldap-server-veri-tls-credentials
type: Opaque
stringData:
  connections.secretKey: thisISaSECRET_1234
  connections.sqlalchemyDatabaseUri: postgresql://superset:superset@superset-postgresql.default.svc.cluster.local/superset
  # The adminUser has to be configured, but has no use (it can't log in). See https://github.com/stackabletech/superset-operator/issues/193
  adminUser.username: admin
  adminUser.firstname: Superset
  adminUser.lastname: Admin
  adminUser.email: admin@superset.com
  adminUser.password: admin
---
apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: superset-with-ldap-server-veri-tls-ldap
spec:
  provider:
    ldap:
      hostname: openldap.default.svc.cluster.local
      port: 636
      searchBase: ou=users,dc=example,dc=org
      ldapFieldNames:
        uid: uid
      bindCredentials:
        secretClass: superset-with-ldap-server-veri-tls-ldap-bind
      tls:
        verification:
          server:
            caCert:
              secretClass: openldap-tls
---
apiVersion: secrets.stackable.tech/v1alpha1
kind: SecretClass
metadata:
  name: superset-with-ldap-server-veri-tls-ldap-bind
spec:
  backend:
    k8sSearch:
      searchNamespace:
        pod: {}
---
apiVersion: v1
kind: Secret
metadata:
  name: superset-with-ldap-server-veri-tls-ldap-bind
  labels:
    secrets.stackable.tech/class: superset-with-ldap-server-veri-tls-ldap-bind
stringData:
  user: cn=admin,dc=example,dc=org
  password: admin
---
apiVersion: superset.stackable.tech/v1alpha1
kind: SupersetCluster
metadata:
  name: superset-with-ldap-server-veri-tls
spec:
  image:
    productVersion: 4.1.2
  clusterConfig:
    authentication:
      - authenticationClass: superset-with-ldap-server-veri-tls-ldap
        userRegistrationRole: Admin
    credentialsSecret: superset-with-ldap-server-veri-tls-credentials
  nodes:
    roleConfig:
      listenerClass: external-unstable
    roleGroups:
      default:
        replicas: 1