Skip to content
This repository was archived by the owner on Nov 26, 2025. It is now read-only.

Commit 517d8b2

Browse files
butonicbutonic
committed
introduce internal openldap
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
1 parent 593c879 commit 517d8b2

File tree

11 files changed

+323
-0
lines changed

11 files changed

+323
-0
lines changed

‎charts/opencloud/README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,27 @@ keycloak:
362362
| `postgres.persistence.storageClass` | Storage class | `""` |
363363
| `postgres.persistence.accessMode` | Access mode | `ReadWriteOnce` |
364364
365+
### LDAP Settings
366+
367+
This chart optionally deploys an internal OpenLDAP server for identity management. When enabled it replaces the built in idm.
368+
369+
| Parameter | Description | Default |
370+
| ---------------------------------------- | --------------------------------------------------------------------- | ------------------ |
371+
| `ldap.internal.enabled` | Enable internal OpenLDAP server | `false` |
372+
| `ldap.internal.image.registry` | OpenLDAP image registry | `docker.io` |
373+
| `ldap.internal.image.repository` | OpenLDAP image repository | `bitnami/openldap` |
374+
| `ldap.internal.image.tag` | OpenLDAP image tag | `"2.6"` |
375+
| `ldap.internal.image.pullPolicy` | Image pull policy | `IfNotPresent` |
376+
| `ldap.internal.existingSecret` | Name of existing Kubernetes Secret (must contain key `adminPassword`) | `""` |
377+
| `ldap.internal.adminPassword` | Admin password (ignored if `existingSecret` is set) | `adminpass` |
378+
| `ldap.internal.resources` | CPU/Memory resource requests/limits | See values.yaml |
379+
| `ldap.internal.persistence.enabled` | Enable persistence for OpenLDAP | `true` |
380+
| `ldap.internal.persistence.size` | Size of the persistent volume | `1Gi` |
381+
| `ldap.internal.persistence.storageClass` | Storage class | `""` |
382+
| `ldap.internal.persistence.accessMode` | Access mode | `ReadWriteOnce` |
383+
384+
> 💡 If `ldap.internal.existingSecret` is set, it must contain a key named `adminPassword`.
385+
> If not set, a random password is generated during installation and stored in a Helm-managed secret. This secret uses the annotation `helm.sh/resource-policy: keep` to prevent it from being overwritten on upgrade.
365386
366387
### OnlyOffice Settings
367388

‎charts/opencloud/files/openldap/ldif/10_base.ldif‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
dn: dc=opencloud,dc=eu
2+
objectClass: organization
3+
objectClass: dcObject
4+
dc: opencloud
5+
o: openCloud
6+
7+
dn: ou=users,dc=opencloud,dc=eu
8+
objectClass: organizationalUnit
9+
ou: users
10+
11+
dn: cn=admin,dc=opencloud,dc=eu
12+
objectClass: inetOrgPerson
13+
objectClass: person
14+
cn: admin
15+
sn: admin
16+
uid: ldapadmin
17+
18+
dn: ou=groups,dc=opencloud,dc=eu
19+
objectClass: organizationalUnit
20+
ou: groups
21+
22+
dn: ou=custom,ou=groups,dc=opencloud,dc=eu
23+
objectClass: organizationalUnit
24+
ou: custom

‎charts/opencloud/files/openldap/schemas/10_opencloud_schema.ldif‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# This LDIF files describes the OpenCloud schema
2+
dn: cn=opencloud,cn=schema,cn=config
3+
objectClass: olcSchemaConfig
4+
cn: opencloud
5+
olcObjectIdentifier: openCloudOid 1.3.6.1.4.1.63016
6+
# We'll use openCloudOid:1 subarc for LDAP related stuff
7+
# openCloudOid:1.1 for AttributeTypes and openCloudOid:1.2 for ObjectClasses
8+
olcAttributeTypes: ( openCloudOid:1.1.1 NAME 'openCloudUUID'
9+
DESC 'A non-reassignable and persistent account ID)'
10+
EQUALITY uuidMatch
11+
SUBSTR caseIgnoreSubstringsMatch
12+
SYNTAX 1.3.6.1.1.16.1 SINGLE-VALUE )
13+
olcAttributeTypes: ( openCloudOid:1.1.2 NAME 'openCloudExternalIdentity'
14+
DESC 'A triple separated by "$" representing the objectIdentity resource type of the Graph API ( signInType $ issuer $ issuerAssignedId )'
15+
EQUALITY caseIgnoreMatch
16+
SUBSTR caseIgnoreSubstringsMatch
17+
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
18+
olcAttributeTypes: ( openCloudOid:1.1.3 NAME 'openCloudUserEnabled'
19+
DESC 'A boolean value indicating if the user is enabled'
20+
EQUALITY booleanMatch
21+
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE)
22+
olcAttributeTypes: ( openCloudOid:1.1.4 NAME 'openCloudUserType'
23+
DESC 'User type (e.g. Member or Guest)'
24+
EQUALITY caseIgnoreMatch
25+
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
26+
olcAttributeTypes: ( openCloudOid:1.1.5 NAME 'openCloudLastSignInTimestamp'
27+
DESC 'The timestamp of the last sign-in'
28+
EQUALITY generalizedTimeMatch
29+
ORDERING generalizedTimeOrderingMatch
30+
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
31+
olcObjectClasses: ( openCloudOid:1.2.1 NAME 'openCloudObject'
32+
DESC 'OpenCloud base objectclass'
33+
AUXILIARY
34+
MAY ( openCloudUUID ) )
35+
olcObjectClasses: ( openCloudOid:1.2.2 NAME 'openCloudUser'
36+
DESC 'OpenCloud User objectclass'
37+
SUP openCloudObject
38+
AUXILIARY
39+
MAY ( openCloudExternalIdentity $ openCloudUserEnabled $ openCloudUserType $ openCloudLastSignInTimestamp) )

‎charts/opencloud/templates/_helpers/tpl.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,13 @@ Create a fully qualified PostgreSQL name.
8282
{{- printf "%s-postgres" (include "opencloud.fullname" .) | trunc 63 | trimSuffix "-" }}
8383
{{- end }}
8484

85+
{{/*
86+
Create a fully qualified OpenLDAP name.
87+
*/}}
88+
{{- define "opencloud.openldap.fullname" -}}
89+
{{- printf "%s-openldap" (include "opencloud.fullname" .) | trunc 63 | trimSuffix "-" }}
90+
{{- end }}
91+
8592
{{/*
8693
Create a fully qualified MinIO name.
8794
*/}}

‎charts/opencloud/templates/opencloud/deployment.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,9 @@ spec:
151151
{{- if .Values.opencloud.nats.external.enabled }}
152152
{{- $exclude = append $exclude "nats" }}
153153
{{- end }}
154+
{{- if .Values.ldap.internal.enabled }}
155+
{{- $exclude = append $exclude "idm" }}
156+
{{- end }}
154157
{{- if gt (len $exclude) 0 }}
155158
- name: OC_EXCLUDE_RUN_SERVICES
156159
value: {{ join "," $exclude | quote }}
@@ -237,6 +240,8 @@ spec:
237240
value: "true"
238241
- name: WEB_OIDC_CLIENT_ID
239242
value: {{ .Values.global.oidc.clientId | quote}}
243+
# this is different from the compose setup, where the sub claim is used
244+
# users must not change their username in the idp or they will no longer be able to access their data
240245
- name: PROXY_USER_OIDC_CLAIM
241246
value: "preferred_username"
242247
- name: PROXY_USER_CS3_CLAIM
@@ -260,6 +265,36 @@ spec:
260265
- name: WEB_OIDC_SCOPE
261266
value: "openid profile email groups roles"
262267
{{- end }}
268+
269+
{{- if .Values.ldap.internal.enabled }}
270+
# opencloud manages the ldap server, it is considered writable
271+
- name: OC_LDAP_URI
272+
value: "ldap://{{ include "opencloud.openldap.fullname" . }}:1389"
273+
- name: OC_LDAP_INSECURE
274+
value: "true"
275+
- name: OC_LDAP_BIND_DN
276+
value: "cn=admin,dc=opencloud,dc=eu"
277+
278+
- name: OC_LDAP_BIND_PASSWORD
279+
valueFrom:
280+
secretKeyRef:
281+
name: {{ include "opencloud.openldap.fullname" . }}
282+
key: adminPassword
283+
284+
- name: OC_LDAP_GROUP_BASE_DN
285+
value: "ou=groups,dc=opencloud,dc=eu"
286+
- name: OC_LDAP_USER_BASE_DN
287+
value: "ou=users,dc=opencloud,dc=eu"
288+
- name: OC_LDAP_USER_FILTER
289+
value: "(objectclass=inetOrgPerson)"
290+
# opencloud will roll an opencloudUUID for users and groups
291+
- name: GRAPH_LDAP_SERVER_UUID
292+
value: "false"
293+
# usermanagement is done in keycloak, so we disable editing user properties in opencloud
294+
- name: FRONTEND_READONLY_USER_ATTRIBUTES
295+
value: "user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.accountEnabled,user.appRoleAssignments"
296+
{{- end }}
297+
263298
# Admin user password
264299
- name: IDM_ADMIN_PASSWORD
265300
valueFrom:

‎charts/opencloud/templates/openldap/configmap.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{{- if .Values.ldap.internal.enabled }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "opencloud.openldap.fullname" . }}-config
6+
labels:
7+
{{- include "opencloud.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: openldap
9+
data:
10+
10_opencloud_schema.ldif: |-
11+
{{- .Files.Get "files/openldap/schemas/10_opencloud_schema.ldif" | nindent 4 }}
12+
10_base.ldif: |-
13+
{{- .Files.Get "files/openldap/ldif/10_base.ldif" | nindent 4 }}
14+
{{- end }}

‎charts/opencloud/templates/openldap/deployment.yaml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{{- if .Values.ldap.internal.enabled }}
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: {{ include "opencloud.openldap.fullname" . }}
6+
labels:
7+
{{- include "opencloud.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: openldap
9+
spec:
10+
replicas: 1
11+
selector:
12+
matchLabels:
13+
{{- include "opencloud.selectorLabels" . | nindent 6 }}
14+
app.kubernetes.io/component: openldap
15+
strategy:
16+
type: Recreate
17+
template:
18+
metadata:
19+
labels:
20+
{{- include "opencloud.selectorLabels" . | nindent 8 }}
21+
app.kubernetes.io/component: openldap
22+
spec:
23+
containers:
24+
- name: openldap
25+
image: {{ include "opencloud.image" (dict "imageValues" .Values.ldap.internal.image "global" .Values.global) | quote }}
26+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.ldap.internal.image.pullPolicy "global" .Values.global) }}
27+
securityContext:
28+
allowPrivilegeEscalation: false
29+
capabilities:
30+
drop:
31+
- ALL
32+
add:
33+
- NET_BIND_SERVICE # see https://github.com/bitnami/containers/issues/40841
34+
runAsNonRoot: true
35+
seccompProfile:
36+
type: RuntimeDefault
37+
env:
38+
- name: LDAP_ROOT
39+
value: "dc=opencloud,dc=eu"
40+
- name: LDAP_ADMIN_DN
41+
value: "cn=admin,dc=opencloud,dc=eu"
42+
- name: LDAP_ADMIN_USERNAME
43+
value: "admin"
44+
- name: LDAP_ADMIN_PASSWORD
45+
valueFrom:
46+
secretKeyRef:
47+
name: {{ .Values.ldap.internal.existingSecret | default (include "opencloud.openldap.fullname" .) }}
48+
key: adminPassword
49+
- name: LDAP_CUSTOM_LDIF_DIR
50+
value: "/custom-ldifs"
51+
ports:
52+
- name: ldap
53+
containerPort: 1389
54+
- name: ldaps
55+
containerPort: 1636
56+
volumeMounts:
57+
- name: custom-ldif
58+
mountPath: /schemas/10_opencloud_schema.ldif
59+
subPath: 10_opencloud_schema.ldif
60+
- name: custom-ldif
61+
mountPath: /custom-ldifs/10_base.ldif
62+
subPath: 10_base.ldif
63+
#- name: custom-ldif
64+
# mountPath: /ldifs/20_admin.ldif
65+
# subPath: 20_admin.ldif
66+
{{- if .Values.ldap.internal.persistence.enabled }}
67+
- name: data
68+
mountPath: /bitnami/openldap
69+
{{- end }}
70+
resources:
71+
{{- toYaml .Values.ldap.internal.resources | nindent 12 }}
72+
volumes:
73+
- name: custom-ldif
74+
configMap:
75+
name: {{ include "opencloud.openldap.fullname" . }}-config
76+
{{- if .Values.ldap.internal.persistence.enabled }}
77+
- name: data
78+
persistentVolumeClaim:
79+
claimName: {{ include "opencloud.openldap.fullname" . }}-data
80+
{{- end }}
81+
{{- end }}

‎charts/opencloud/templates/openldap/pvc.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{- if .Values.ldap.internal.persistence.enabled }}
2+
apiVersion: v1
3+
kind: PersistentVolumeClaim
4+
metadata:
5+
name: {{ include "opencloud.openldap.fullname" . }}-data
6+
annotations:
7+
"helm.sh/resource-policy": "keep"
8+
labels:
9+
{{- include "opencloud.labels" . | nindent 4 }}
10+
app.kubernetes.io/component: openldap
11+
spec:
12+
accessModes:
13+
- {{ .Values.ldap.internal.persistence.accessMode | quote }}
14+
resources:
15+
requests:
16+
storage: {{ .Values.ldap.internal.persistence.size | quote }}
17+
{{- if .Values.ldap.internal.persistence.storageClass }}
18+
{{- if (eq "-" .Values.ldap.internal.persistence.storageClass) }}
19+
storageClassName: ""
20+
{{- else }}
21+
storageClassName: {{ .Values.ldap.internal.persistence.storageClass | quote }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}

‎charts/opencloud/templates/openldap/secrets.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if and .Values.ldap.internal.enabled (not .Values.ldap.internal.existingSecret) }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ include "opencloud.openldap.fullname" . }}
6+
labels:
7+
app.kubernetes.io/component: openldap
8+
type: Opaque
9+
stringData:
10+
adminPassword: {{ .Values.ldap.internal.adminPassword }}
11+
{{- end }}

‎charts/opencloud/templates/openldap/service.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if .Values.ldap.internal.enabled }}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: {{ include "opencloud.openldap.fullname" . }}
6+
labels:
7+
{{- include "opencloud.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: openldap
9+
spec:
10+
type: ClusterIP
11+
ports:
12+
- port: 1389
13+
targetPort: ldap
14+
protocol: TCP
15+
name: ldap
16+
- port: 1636
17+
targetPort: ldaps
18+
protocol: TCP
19+
name: ldaps
20+
selector:
21+
{{- include "opencloud.selectorLabels" . | nindent 4 }}
22+
app.kubernetes.io/component: openldap
23+
{{- end }}

0 commit comments

Comments
 (0)