OpenCloud: Use native bash substitution in config file

- Removed init-config container (OpenCloud supports native bash substitution)
- Mount opencloud-config ConfigMap directly to /etc/opencloud
- Added gateway storage configuration with ${OC_STORAGE_MOUNT_ID|}
- Updated all LDAP services to use ${OPENLDAP_ADMIN_PASSWORD|} substitution
- Added auth-basic auth_providers structure

Services starting successfully:
- Gateway, users, sharing services running
- Users service connected to external OpenLDAP
- Remaining: auth-basic bind_password configuration issue

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

add-user-andreas.ldif

@@ -0,0 +1,35 @@
+# Add user andreas.leinen to OpenLDAP
+# Username: andreas.leinen
+# Email: andreas.leinen@basicstack.de
+# Password: will be set below
+
+# Create user entry
+dn: uid=andreas.leinen,ou=users,dc=basicstack,dc=de
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: shadowAccount
+uid: andreas.leinen
+cn: Andreas Leinen
+sn: Leinen
+givenName: Andreas
+displayName: Andreas Leinen
+mail: andreas.leinen@basicstack.de
+uidNumber: 10001
+gidNumber: 10001
+homeDirectory: /home/andreas.leinen
+loginShell: /bin/bash
+# Password: OpenCloud2024! (hashed with SSHA)
+# To generate: slappasswd -s "your_password"
+userPassword: {SSHA}placeholder_will_be_set_via_ldappasswd
+
+# Add user to opencloudUsers group
+dn: cn=opencloudUsers,ou=groups,dc=basicstack,dc=de
+changetype: modify
+add: member
+member: uid=andreas.leinen,ou=users,dc=basicstack,dc=de
+
+# Add user to opencloudAdmins group (for admin access)
+dn: cn=opencloudAdmins,ou=groups,dc=basicstack,dc=de
+changetype: modify
+add: member
+member: uid=andreas.leinen,ou=users,dc=basicstack,dc=de

apps/opencloud/opencloud-configmap.yaml

@@ -16,7 +16,7 @@ data:
           uri: ldap://openldap.opencloud.svc.cluster.local:389
           base_dn: dc=basicstack,dc=de
           bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD}
+          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
           user_base_dn: ou=users,dc=basicstack,dc=de
           group_base_dn: ou=groups,dc=basicstack,dc=de
           insecure: true
@@ -30,6 +30,17 @@ data:
         user_oidc_claim: preferred_username
       enable_basic_auth: false
 
+    # Auth-basic service - LDAP configuration
+    auth-basic:
+      auth_providers:
+        ldap:
+          uri: ldap://openldap.opencloud.svc.cluster.local:389
+          base_dn: dc=basicstack,dc=de
+          bind_dn: cn=admin,dc=basicstack,dc=de
+          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
+          user_base_dn: ou=users,dc=basicstack,dc=de
+          insecure: true
+
     # Users service - external LDAP
     users:
       drivers:
@@ -37,7 +48,7 @@ data:
           uri: ldap://openldap.opencloud.svc.cluster.local:389
           base_dn: dc=basicstack,dc=de
           bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD}
+          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
           user_base_dn: ou=users,dc=basicstack,dc=de
           user_filter: (objectClass=inetOrgPerson)
           user_object_class: inetOrgPerson
@@ -50,8 +61,13 @@ data:
           uri: ldap://openldap.opencloud.svc.cluster.local:389
           base_dn: dc=basicstack,dc=de
           bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD}
+          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
           group_base_dn: ou=groups,dc=basicstack,dc=de
           group_filter: (objectClass=groupOfNames)
           group_object_class: groupOfNames
           insecure: true
+
+    # Gateway service - storage configuration
+    gateway:
+      storage_registry:
+        storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}

apps/opencloud/opencloud-deployment.yaml

@@ -69,142 +69,6 @@ spec:
           runAsUser: 1000
           runAsGroup: 1000
           runAsNonRoot: true
-      - name: init-config
-        image: busybox:1.36
-        command:
-          - sh
-          - -c
-          - |
-            # Create output directory
-            mkdir -p /etc/opencloud-processed
-
-            # Simple variable expansion using shell
-            # Read template and expand ${VAR} patterns
-            while IFS= read -r line; do
-              # Expand ${OPENLDAP_ADMIN_PASSWORD}
-              line=$(echo "$line" | sed "s|\${OPENLDAP_ADMIN_PASSWORD}|$OPENLDAP_ADMIN_PASSWORD|g")
-              echo "$line"
-            done < /etc/opencloud-template/opencloud.yaml > /etc/opencloud-processed/opencloud.yaml
-
-            echo "Config file processed successfully"
-            echo "First 20 lines:"
-            head -20 /etc/opencloud-processed/opencloud.yaml
-        env:
-        # Pass all environment variables needed for substitution
-        - name: OC_GRAPH_LDAP_BIND_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: graph-ldap-bind-password
-        - name: OPENLDAP_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: openldap-admin-secret
-              key: admin-password
-        - name: OC_IDM_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: idm-admin-password
-        - name: OC_IDM_IDM_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: idm-idm-password
-        - name: OC_IDM_REVA_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: idm-reva-password
-        - name: OC_IDM_IDP_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: idm-idp-password
-        - name: OC_TOKEN_MANAGER_JWT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-jwt-secret
-              key: jwt-secret
-        - name: OC_MACHINE_AUTH_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: machine-auth-api-key
-        - name: OC_SYSTEM_USER_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: system-user-api-key
-        - name: OC_TRANSFER_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: transfer-secret
-        - name: OC_URL_SIGNING_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: url-signing-secret
-        - name: OC_SYSTEM_USER_ID
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: system-user-id
-        - name: OC_ADMIN_USER_ID
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: admin-user-id
-        - name: OC_GRAPH_APPLICATION_ID
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: graph-application-id
-        - name: OC_SERVICE_ACCOUNT_ID
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: service-account-id
-        - name: OC_SERVICE_ACCOUNT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: service-account-secret
-        - name: OC_COLLABORATION_WOPI_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: collaboration-wopi-secret
-        - name: OC_THUMBNAILS_TRANSFER_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: thumbnails-transfer-secret
-        - name: OC_STORAGE_MOUNT_ID
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: storage-mount-id
-        - name: OC_USERS_LDAP_BIND_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: ldap-bind-password
-        - name: OC_GROUPS_LDAP_BIND_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-config-secrets
-              key: ldap-bind-password
-        volumeMounts:
-        - name: opencloud-config-template
-          mountPath: /etc/opencloud-template
-        - name: opencloud-config-processed
-          mountPath: /etc/opencloud-processed
-        securityContext:
-          runAsUser: 1000
-          runAsGroup: 1000
-          runAsNonRoot: true
       containers:
       - name: opencloud
         image: opencloudeu/opencloud-rolling:7.2.0
@@ -584,7 +448,7 @@ spec:
         volumeMounts:
         - name: opencloud-data
           mountPath: /var/lib/opencloud
-        - name: opencloud-config-processed
+        - name: opencloud-config
           mountPath: /etc/opencloud
         resources:
           requests:
@@ -612,11 +476,9 @@ spec:
       - name: opencloud-data
         persistentVolumeClaim:
           claimName: opencloud-data
-      - name: opencloud-config-template
+      - name: opencloud-config
         configMap:
           name: opencloud-config
-      - name: opencloud-config-processed
-        emptyDir: {}
 ---
 # Ingress
 apiVersion: networking.k8s.io/v1