Skip to content

Commit 1fbbc0c

Browse files
alexmorboalexmorbo
committed
[lldap] Support ldaps, use rootless image for read only filesystem, fix selectorLabels
1 parent 541de37 commit 1fbbc0c

File tree

7 files changed

+78
-28
lines changed

7 files changed

+78
-28
lines changed

‎charts/lldap/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ kubeVersion: ">=1.23.0-0"
33
name: lldap
44
description: LLDAP helm chart for Kubernetes
55
type: application
6-
version: 1.0.6
6+
version: 1.0.7
77
appVersion: "0.6.1"
88
maintainers:
99
- name: AlexMorbo

‎charts/lldap/README.md

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
# lldap
33

4-
![Version: 1.0.6](https://img.shields.io/badge/Version-1.0.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.1](https://img.shields.io/badge/AppVersion-0.6.1-informational?style=flat-square)
4+
![Version: 1.0.7](https://img.shields.io/badge/Version-1.0.7-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.1](https://img.shields.io/badge/AppVersion-0.6.1-informational?style=flat-square)
55

66
LLDAP helm chart for Kubernetes
77

@@ -33,10 +33,9 @@ helm install lldap oci://ghcr.io/alexmorbo/helm-charts/lldap
3333
| Key | Type | Default | Description |
3434
|-----|------|---------|-------------|
3535
| affinity | object | `{}` | |
36-
| annotations | object | `{}` | |
37-
| env.GID | string | `"1001"` | |
36+
| env.GID | string | `"1000"` | |
3837
| env.TZ | string | `"UTC"` | |
39-
| env.UID | string | `"1001"` | |
38+
| env.UID | string | `"1000"` | |
4039
| extraEnv | list | `[]` | Environment variables to add to the lldap pods |
4140
| extraEnvFrom | list | `[]` | Environment variables from secrets or configmaps to add to the lldap pods |
4241
| extraInitContainers | list | `[]` | |
@@ -62,7 +61,8 @@ helm install lldap oci://ghcr.io/alexmorbo/helm-charts/lldap
6261
| persistence.size | string | `"100Mi"` | Size of persistent disk |
6362
| persistence.storageClass | string | `""` | |
6463
| persistence.volumeName | string | `""` | Name of the permanent volume to reference in the claim. Can be used to bind to existing volumes. |
65-
| podSecurityContext.fsGroup | int | `65534` | |
64+
| podAnnotations | object | `{}` | |
65+
| podSecurityContext.fsGroup | int | `1000` | |
6666
| podSecurityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | |
6767
| replicaCount | int | `1` | |
6868
| resources | object | `{}` | |
@@ -75,17 +75,19 @@ helm install lldap oci://ghcr.io/alexmorbo/helm-charts/lldap
7575
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
7676
| securityContext.privileged | bool | `false` | |
7777
| securityContext.readOnlyRootFilesystem | bool | `true` | |
78-
| securityContext.runAsGroup | int | `65534` | |
78+
| securityContext.runAsGroup | int | `1000` | |
7979
| securityContext.runAsNonRoot | bool | `true` | |
80-
| securityContext.runAsUser | int | `65534` | |
80+
| securityContext.runAsUser | int | `1000` | |
8181
| securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
8282
| service.annotations | object | `{}` | |
8383
| service.http_port | int | `17170` | |
8484
| service.ldap_port | int | `3890` | |
85+
| service.ldaps_enabled | bool | `false` | |
86+
| service.ldaps_port | int | `6360` | |
8587
| service.type | string | `"ClusterIP"` | |
8688
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
8789
| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials? |
8890
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
8991
| serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template |
9092
| tolerations | list | `[]` | |
91-
| updateStrategy | object | `{"type":"Recreate"}` | Deployment strategy |
93+
| updateStrategy | object | `{"type":"RollingUpdate"}` | Deployment strategy |

‎charts/lldap/templates/_helpers.tpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,3 +82,10 @@ Create the name of the secret to use
8282
{{- define "lldap.secretName" -}}
8383
{{- printf "%s-secret" (include "lldap.fullname" .) }}
8484
{{- end }}
85+
86+
{{/*
87+
Create the name of the tls secret to use
88+
*/}}
89+
{{- define "lldap.certsSecretName" -}}
90+
{{- printf "%s-tls" (include "lldap.fullname" .) }}
91+
{{- end }}

‎charts/lldap/templates/deployment.yaml

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,25 @@ metadata:
44
name: {{ include "lldap.fullname" . }}
55
labels:
66
{{- include "lldap.labels" . | nindent 4 }}
7-
{{- with .Values.annotations }}
7+
{{- with .Values.podAnnotations }}
88
annotations:
99
{{- toYaml . | nindent 4 }}
1010
{{- end }}
1111
spec:
1212
replicas: {{ .Values.replicaCount }}
1313
selector:
1414
matchLabels:
15-
{{- include "lldap.labels" . | nindent 6 }}
15+
{{- include "lldap.selectorLabels" . | nindent 6 }}
1616
strategy:
1717
type: {{ .Values.updateStrategy.type }}
1818
template:
1919
metadata:
2020
labels:
2121
{{- include "lldap.labels" . | nindent 8 }}
22-
{{- with .Values.annotations }}
22+
{{- with .Values.podLabels }}
23+
{{- toYaml . | nindent 8 }}
24+
{{- end }}
25+
{{- with .Values.podAnnotations }}
2326
annotations:
2427
{{- toYaml . | nindent 8 }}
2528
{{- end }}
@@ -37,10 +40,18 @@ spec:
3740
{{- end }}
3841
containers:
3942
- name: {{ .Chart.Name }}
43+
{{- $imageSuffix := "" }}
44+
{{- if .Values.securityContext.readOnlyRootFilesystem }}
45+
{{- $imageSuffix = "-rootless" }}
46+
{{- end }}
4047
{{- if .Values.image.sha }}
41-
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}@sha256:{{ .Values.image.sha }}"
48+
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}{{ $imageSuffix }}@sha256:{{ .Values.image.sha }}"
4249
{{- else }}
43-
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
50+
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}{{ $imageSuffix }}"
51+
{{- end }}
52+
{{- with .Values.securityContext }}
53+
securityContext:
54+
{{- toYaml . | nindent 12 }}
4455
{{- end }}
4556
imagePullPolicy: {{ .Values.image.pullPolicy }}
4657
{{- with .Values.resources }}
@@ -69,6 +80,14 @@ spec:
6980
secretKeyRef:
7081
name: {{ include "lldap.secretName" . }}
7182
key: lldap-ldap-user-pass
83+
{{- if .Values.service.ldaps_enabled }}
84+
- name: LLDAP_LDAPS_OPTIONS__ENABLED
85+
value: "true"
86+
- name: LLDAP_LDAPS_OPTIONS__CERT_FILE
87+
value: "/etc/ssl/certs/tls.crt"
88+
- name: LLDAP_LDAPS_OPTIONS__KEY_FILE
89+
value: "/etc/ssl/certs/tls.key"
90+
{{- end }}
7291
{{- with .Values.extraEnv }}
7392
{{- toYaml . | nindent 12 }}
7493
{{- end }}
@@ -83,17 +102,32 @@ spec:
83102
- name: ldap
84103
containerPort: {{ .Values.service.ldap_port }}
85104
protocol: TCP
86-
{{- if .Values.persistence.enabled }}
105+
{{- if .Values.service.ldaps_enabled }}
106+
- name: ldaps
107+
containerPort: {{ .Values.service.ldaps_port }}
108+
protocol: TCP
109+
{{- end }}
87110
volumeMounts:
88111
- mountPath: /data
89112
name: lldap-data
90-
{{- end }}
91-
{{- if .Values.persistence.enabled }}
113+
{{- if .Values.service.ldaps_enabled }}
114+
- mountPath: /etc/ssl/certs
115+
name: lldap-certs
116+
{{- end }}
92117
volumes:
93118
- name: lldap-data
119+
{{- if .Values.persistence.enabled }}
94120
persistentVolumeClaim:
95121
claimName: {{ include "lldap.persistenceName" . }}
96-
{{- end }}
122+
{{- else }}
123+
emptyDir: {}
124+
{{- end }}
125+
{{- if .Values.service.ldaps_enabled }}
126+
- name: lldap-certs
127+
secret:
128+
secretName: {{ include "lldap.certsSecretName" . }}
129+
defaultMode: 0644
130+
{{- end }}
97131
{{- with .Values.nodeSelector }}
98132
nodeSelector:
99133
{{- toYaml . | nindent 8 }}

‎charts/lldap/templates/ingress.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ spec:
2020
{{- range .hosts }}
2121
- {{ . | quote }}
2222
{{- end }}
23-
secretName: {{ .secretName }}
23+
secretName: {{ include "lldap.certsSecretName" $ }}
2424
{{- end }}
2525
{{- end }}
2626
rules:

‎charts/lldap/templates/service.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ spec:
1515
targetPort: ldap
1616
protocol: TCP
1717
name: ldap
18+
{{- if .Values.service.ldaps_enabled }}
19+
- port: {{ .Values.service.ldaps_port }}
20+
targetPort: ldaps
21+
protocol: TCP
22+
name: ldaps
23+
{{- end }}
1824
- port: {{ .Values.service.http_port }}
1925
targetPort: http
2026
protocol: TCP

‎charts/lldap/values.yaml

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ imagePullSecrets: []
1212
nameOverride: ""
1313
fullnameOverride: ""
1414

15-
annotations: {}
15+
podAnnotations: {}
1616

1717
# -- Deployment strategy
1818
updateStrategy:
19-
type: Recreate
19+
type: RollingUpdate
2020

2121
# -- Environment variables to add to the lldap pods
2222
extraEnv: []
@@ -60,8 +60,8 @@ persistence:
6060

6161
env:
6262
TZ: "UTC"
63-
GID: "1001"
64-
UID: "1001"
63+
GID: "1000"
64+
UID: "1000"
6565

6666
resources: {}
6767
# limits:
@@ -78,7 +78,7 @@ tolerations: []
7878
affinity: {}
7979

8080
podSecurityContext:
81-
fsGroup: 65534
81+
fsGroup: 1000
8282
fsGroupChangePolicy: OnRootMismatch
8383

8484
securityContext:
@@ -89,16 +89,18 @@ securityContext:
8989
readOnlyRootFilesystem: true
9090
runAsNonRoot: true
9191
privileged: false
92-
runAsUser: 65534
93-
runAsGroup: 65534
92+
runAsUser: 1000
93+
runAsGroup: 1000
9494
seccompProfile:
9595
type: RuntimeDefault
9696

9797
service:
9898
type: ClusterIP
9999
annotations: {}
100100
ldap_port: 3890
101+
ldaps_port: 6360
101102
http_port: 17170
103+
ldaps_enabled: false
102104

103105
ingress:
104106
enabled: false
@@ -112,6 +114,5 @@ ingress:
112114
- path: /
113115
pathType: ImplementationSpecific
114116
tls: []
115-
# - secretName: chart-example-tls
116-
# hosts:
117+
# - hosts:
117118
# - chart-example.local

0 commit comments

Comments
 (0)