162 lines
3.9 KiB
YAML
162 lines
3.9 KiB
YAML
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: openldap
|
|
namespace: openldap
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 4G
|
|
storageClassName: cephfs-hyper
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openldap
|
|
namespace: openldap
|
|
labels:
|
|
app: openldap
|
|
spec:
|
|
replicas: 1
|
|
minReadySeconds: 10
|
|
selector:
|
|
matchLabels:
|
|
app: openldap
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: openldap
|
|
spec:
|
|
dnsConfig:
|
|
options:
|
|
- name: ndots
|
|
value: "1"
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: openldap
|
|
image: osixia/openldap
|
|
imagePullPolicy: IfNotPresent
|
|
#securityContext:
|
|
# privileged: true
|
|
args:
|
|
- "--copy-service"
|
|
#- "--loglevel"
|
|
#- "debug"
|
|
ports:
|
|
- containerPort: 389
|
|
protocol: TCP
|
|
- containerPort: 636
|
|
protocol: TCP
|
|
#livenessProbe:
|
|
# tcpSocket:
|
|
# port: 389
|
|
# initialDelaySeconds: 230
|
|
# periodSeconds: 10
|
|
# failureThreshold: 12
|
|
#readinessProbe:
|
|
# tcpSocket:
|
|
# port: 636
|
|
# initialDelaySeconds: 220
|
|
# periodSeconds: 10
|
|
# failureThreshold: 12
|
|
env:
|
|
#- name: DNSMASQ_USER
|
|
# value: root
|
|
- name: LDAP_LOG_LEVEL
|
|
#value: "stats"
|
|
value: "768"
|
|
- name: LDAP_TLS_CIPHER_SUITE
|
|
value: "SECURE256:+SECURE128:+VERS-TLS1.2:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC"
|
|
- name: LDAP_ORGANISATION
|
|
value: "undercloud"
|
|
- name: LDAP_DOMAIN
|
|
value: "undercloud.local"
|
|
- name: LDAP_RFC2307BIS_SCHEMA
|
|
value: "true"
|
|
- name: LDAP_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: admin
|
|
key: pw
|
|
- name: LDAP_CONFIG_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: admin
|
|
key: pw
|
|
- name: LDAP_TLS_CRT_FILENAME
|
|
value: "tls.crt"
|
|
- name: LDAP_TLS_KEY_FILENAME
|
|
value: "tls.key"
|
|
- name: LDAP_TLS_VERIFY_CLIENT
|
|
value: "try"
|
|
#- name: LDAP_TLS_ENFORCE
|
|
# value: "true"
|
|
volumeMounts:
|
|
- mountPath: /var/lib/ldap
|
|
name: openldap
|
|
subPath: ldap
|
|
- mountPath: /etc/ldap/slapd.d
|
|
name: openldap
|
|
subPath: slapd
|
|
- name: ldif
|
|
mountPath: /container/service/slapd/assets/config/bootstrap/ldif/custom
|
|
- name: root-ca
|
|
mountPath: "/container/service/slapd/assets/certs/ca.crt"
|
|
subPath: trust-bundle.pem
|
|
- name: openldap-tls
|
|
mountPath: "/container/service/slapd/assets/certs/tls.crt"
|
|
subPath: tls.crt
|
|
- name: openldap-tls
|
|
mountPath: "/container/service/slapd/assets/certs/tls.key"
|
|
subPath: tls.key
|
|
volumes:
|
|
- name: openldap
|
|
persistentVolumeClaim:
|
|
claimName: openldap
|
|
readOnly: false
|
|
- name: ldif
|
|
configMap:
|
|
name: ldif
|
|
items:
|
|
- key: structure.ldif
|
|
path: structure.ldif
|
|
- name: openldap-tls
|
|
secret:
|
|
secretName: openldap-tls
|
|
- name: root-ca
|
|
configMap:
|
|
name: undercloud-ca-bundle
|
|
items:
|
|
- key: trust-bundle.pem
|
|
path: trust-bundle.pem
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ldap
|
|
namespace: openldap
|
|
spec:
|
|
clusterIP: '2001:470:7116:f:1::41'
|
|
clusterIPs:
|
|
- '2001:470:7116:f:1::41'
|
|
- 10.0.91.41
|
|
ipFamilies:
|
|
- IPv6
|
|
- IPv4
|
|
ipFamilyPolicy: PreferDualStack
|
|
ports:
|
|
- name: ldap
|
|
port: 389
|
|
protocol: TCP
|
|
targetPort: 389
|
|
- name: ldaps
|
|
port: 636
|
|
protocol: TCP
|
|
targetPort: 636
|
|
selector:
|
|
app: openldap
|
|
#sessionAffinity: None
|
|
type: ClusterIP
|