osixia/openldap - having trouble configuring helm chart to set mounts

Question

Thanks for the assistance in advanced as I'm new, and my questions might come across as a bit green.

So at work, I've been tasked with getting openldap to use TLS via a helm deployment. We are currently using osixia/openldap. So instead of breaking stuff at work (389) is working and I'd rather not disturb it.

Another, SO! I decided to spin up a k3s cluster at home and mimic what we got going on. Clearly we are using actual CA's at work, and I was too lazy to mess with a lets Encrypt. I rolled my own wildcard cert that i'm using for ingress via cert-manager and that seems to be working swimmingly. I then decided to use this same cert for TLS on openldap, because I figured this would be acceptable for the home lab to see if i can get it working.

I've been scaping the bottom of the digital barrel, trying to find out why the arguments/params in the helm chart isn't setting the kubernetes cert. I've tried to set the customTLS: and tls: arguments and the system still ignores it and sets it's own cert.

On top of this, I've tried to set volume mounts to get the certs into the pod that way, and Volumes: and extraVolumeMounts: seems to be ignored. So, i'm convinced i'm missing a part somewhere. Has anyone configure TLS via helm?

this is my yaml file..

# Default values for openldap.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

# Define deployment strategy - IMPORTANT: use rollingUpdate: null when use Recreate strategy.
# It prevents from merging with existing map keys which are forbidden.
strategy: {}
  # type: RollingUpdate
  # rollingUpdate:
  #   maxSurge: 1
  #   maxUnavailable: 0
  #
  # or
  #
  # type: Recreate
  # rollingUpdate: null
image:
  # From repository https://github.com/osixia/docker-openldap
  repository: osixia/openldap
  tag: 1.5.0
  pullPolicy: IfNotPresent


# Spcifies an existing secret to be used for admin and config user passwords
existingSecret: ""

customTLS:
  enabled: true
  secret: "blaklabz-io-tls"  # The name of a kubernetes.io/tls type secret to use for TLS
  CA:
    enabled: true
    secret: "wildcard.blaklabz.io.crt"  # The name of a generic secret to use for custom CA certificate (ca.crt)

tls:
  enabled: true
  secret: "blaklabz-io-tls"
  CA:
    enabled: true
    secret: "wildcard.blaklabz.io.crt"  

logLevel: debug

## Add additional labels to all resources
extraLabels: {}

podAnnotations: {}
service:
  annotations: {}

  ldapPort: 389
  sslLdapPort: 636
  ## List of IP addresses at which the service is available
  ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
  ##
  externalIPs: []

  loadBalancerIP: ""
  loadBalancerSourceRanges: []
  type: ClusterIP

# Additional volumes to be mounted to pod
extraVolumes: 
  - name: ca-certs
    hostPath:
      path: C:/code/home/helm/k3s/openldap/certs/
      type: DirectoryOrCreate
 
extraVolumeMounts: 
  - name: ca-certs
    readOnly: true
    mountPath: "/container/run/service/slapd/assets/certs/"





# Default configuration for openldap as environment variables. These get injected directly in the container.
# Use the env variables from https://github.com/osixia/docker-openldap#beginner-guide
env:
  LDAP_ORGANISATION: "Blaklabz"
  LDAP_DOMAIN: "blaklabz.io"
  LDAP_BACKEND: "hdb"
  LDAP_REQCERT: "allow"
  LDAP_BASE_DN: "dc=blaklabz,dc=io"  
    #LDAP_TLS_CRT_FILENAME: "wildcard.blaklabz.io.crt"
    #LDAP_TLS_KEY_FILENAME: "wildcard.blaklabz.io.key"
    # LDAP_TLS_CA_CRT_FILENAME: "wildcard.blaklabz.io.crt"
  LDAP_BASE_DN: "dc=blaklabz,dc=io"
  LDAP_TLS_ENFORCE: "false"
  LDAP_TLS_VERIFY_CLIENT: "never"  
    

# Default Passwords to use, stored as a secret. If unset, passwords are auto-generated.
# You can override these at install time with
# helm install openldap --set openldap.adminPassword=,openldap.configPassword=
# adminPassword: admin
# configPassword: config

# Custom openldap configuration files used to override default settings
customLdifFiles:
  01-default-users.ldif: |-
    version: 1
      
    # Entry 3: cn=Administrators,dc=blaklabz,dc=io
    dn: cn=Administrators,dc=blaklabz,dc=io
    cn: Administrators
    member: cn=admin,dc=blaklabz,dc=io
    member: cn=ldapadmin,ou=users,dc=blaklabz,dc=io
    objectclass: groupOfNames
    objectclass: top

    # Entry 4: ou=groups,dc=blaklabz,dc=io
    dn: ou=groups,dc=blaklabz,dc=io
    objectclass: organizationalUnit
    objectclass: top
    ou: groups

    # Entry 5: cn=admin,ou=groups,dc=blaklabz,dc=io
    dn: cn=admin,ou=groups,dc=blaklabz,dc=io
    cn: admin
    gidnumber: 500
    memberuid: watkinst
    memberuid: cwatkins
    objectclass: posixGroup
    objectclass: top
    
    # Entry 6: cn=developers,ou=groups,dc=blaklabz,dc=io
    dn: cn=developers,ou=groups,dc=blaklabz,dc=io
    cn: developers
    gidnumber: 501
    memberuid: 1001
    memberuid: dev
    objectclass: posixGroup
    objectclass: top

    # Entry 8: cn=viewers,ou=groups,dc=blaklabz,dc=io
    dn: cn=viewers,ou=groups,dc=blaklabz,dc=io
    cn: viewers
    gidnumber: 502
    memberuid: viewer
    objectclass: posixGroup
    objectclass: top

    # Entry 9: ou=users,dc=blaklabz,dc=io
    dn: ou=users,dc=blaklabz,dc=io
    objectclass: organizationalUnit
    objectclass: top
    ou: users

    # Entry 10: cn=Christy Watkins,ou=users,dc=blaklabz,dc=io
    dn: cn=Christy Watkins,ou=users,dc=blaklabz,dc=io
    cn: Christy Watkins
    gidnumber: 500
    givenname: Christy
    homedirectory: /home/users/cwatkins
    loginshell: /bin/sh
    objectclass: inetOrgPerson
    objectclass: posixAccount
    objectclass: top
    sn: Watkins
    uid: cwatkins
    uidnumber: 1004
    
   
    # Entry 11: cn=dev,ou=users,dc=blaklabz,dc=io
    dn: cn=dev,ou=users,dc=blaklabz,dc=io
    cn: dev
    gidnumber: 501
    givenname: Test1
    homedirectory: /home/users/taccount
    loginshell: /bin/sh
    objectclass: inetOrgPerson
    objectclass: posixAccount
    objectclass: top
    sn: Account
    uid: dev
    uidnumber: 1001
    

    # Entry 12: cn=ldapadmin,ou=users,dc=blaklabz,dc=io
    dn: cn=ldapadmin,ou=users,dc=blaklabz,dc=io
    cn: ldapadmin
    gidnumber: 503
    givenname: ldapadmin
    homedirectory: /home/users/lldapadmin
    loginshell: /bin/sh
    objectclass: inetOrgPerson
    objectclass: posixAccount
    objectclass: top
    sn: ldapadmin
    uid: lldapadmin
    uidnumber: 1002
    
    
    # Entry 13: cn=Thomas,ou=users,dc=blaklabz,dc=io
    dn: cn=Thomas,ou=users,dc=blaklabz,dc=io
    cn: Thomas
    gidnumber: 500
    givenname: watkinst
    homedirectory: /home/users/watkinst
    loginshell: /bin/sh
    objectclass: inetOrgPerson
    objectclass: posixAccount
    objectclass: top
    sn: Watkins
    uid: watkinst
    uidnumber: 1000
    
    
    # Entry 14: cn=viewer,ou=users,dc=blaklabz,dc=io
    dn: cn=viewer,ou=users,dc=blaklabz,dc=io
    cn: viewer
    gidnumber: 502
    givenname: admin
    homedirectory: /home/users/admin
    loginshell: /bin/sh
    objectclass: inetOrgPerson
    objectclass: posixAccount
    objectclass: top
    sn: admin
    uid: viewer
    uidnumber: 1003
    

      
## Persist data to a persistent volume
persistence:
  enabled: true
  ## database data Persistent Volume Storage Class
  ## If defined, storageClassName: 
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  # storageClass: "-"
  accessMode: ReadWriteOnce
  size: 8Gi

resources: {}
 # requests:
 #   cpu: "100m"
 #   memory: "256Mi"
 # limits:
 #   cpu: "500m"
 #   memory: "512Mi"

nodeSelector: {}

tolerations: []

affinity: {}

## test container details
test:
  enabled: false
  image:
    repository: dduportal/bats
    tag: 0.4.0
      #logLevel: info
      #
      #

here is the log..

***  INFO   | 2021-10-14 18:57:21 | openldap GID/UID
***  INFO   | 2021-10-14 18:57:21 | -------------------------------------
***  INFO   | 2021-10-14 18:57:21 | User uid: 911
***  INFO   | 2021-10-14 18:57:21 | User gid: 911
***  INFO   | 2021-10-14 18:57:21 | uid/gid changed: false
***  INFO   | 2021-10-14 18:57:21 | -------------------------------------
***  INFO   | 2021-10-14 18:57:21 | updating file uid/gid ownership
***  INFO   | 2021-10-14 18:57:21 | Start OpenLDAP...
***  INFO   | 2021-10-14 18:57:21 | Waiting for OpenLDAP to start...
***  INFO   | 2021-10-14 18:57:21 | Add TLS config...
***  INFO   | 2021-10-14 18:57:21 | No certificate file and certificate key provided, generate:
***  INFO   | 2021-10-14 18:57:21 | /container/run/service/slapd/assets/certs/ldap.crt and /container/run/servi
ce/slapd/assets/certs/ldap.key
2021/10/14 18:57:21 [INFO] generate received request
2021/10/14 18:57:21 [INFO] received CSR
2021/10/14 18:57:21 [INFO] generating key: ecdsa-384
2021/10/14 18:57:21 [INFO] encoded CSR
2021/10/14 18:57:21 [INFO] signed certificate with serial number 1558723425496628971971287710038808792320609523
27
***  INFO   | 2021-10-14 18:57:21 | Link /container/run/service/:ssl-tools/assets/default-ca/default-ca.pem to
/container/run/service/slapd/assets/certs/ca.crt
***  INFO   | 2021-10-14 18:57:21 | Disable replication config...
***  INFO   | 2021-10-14 18:57:21 | Stop OpenLDAP...
***  INFO   | 2021-10-14 18:57:21 | Configure ldap client TLS configuration...
***  INFO   | 2021-10-14 18:57:21 | Remove config files...
***  INFO   | 2021-10-14 18:57:22 | First start is done...
***  INFO   | 2021-10-14 18:57:22 | Remove file /container/environment/99-default/default.startup.yaml
***  INFO   | 2021-10-14 18:57:22 | Environment files will be proccessed in this order :
Caution: previously defined variables will not be overriden.
/container/environment/99-default/default.yaml

To see how this files are processed and environment variables values,
run this container with '--loglevel debug'
***  INFO   | 2021-10-14 18:57:22 | Running /container/run/process/slapd/run...
61687d92 @(#) $OpenLDAP: slapd 2.4.57+dfsg-1~bpo10+1 (Jan 30 2021 06:59:51) $
        Debian OpenLDAP Maintainers 
61687d92 slapd starting

Blockquote

osixia/openldap - having trouble configuring helm chart to set mounts

Answers (1)

Related Questions