From c3fe072be5760b46f5a3c63a1d836232c99f6fbc Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 5 Jul 2026 16:56:33 +0000
Subject: [PATCH] fix(opencloud): move schema loading from postStart hook to
 standalone Job

The postStart lifecycle hook caused osixia/openldap to crash on startup:
its init script does chown -R on /container/service/slapd/assets/, and
the ConfigMap subPath mount there is read-only, killing the container.

Remove the postStart hook and the schema volume mount from the OpenLDAP
deployment. Add a standalone Kubernetes Job (opencloud-ldap-schema-job.yaml)
that connects via network LDAP as cn=admin,cn=config and loads the schema
after OpenLDAP is confirmed ready. The Job is idempotent (skips if the
schema already exists) and retries up to 10 times on failure.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 apps/opencloud/opencloud-ldap-schema-job.yaml | 68 +++++++++++++++++++
 apps/opencloud/openldap-deployment.yaml       | 27 --------
 2 files changed, 68 insertions(+), 27 deletions(-)
 create mode 100644 apps/opencloud/opencloud-ldap-schema-job.yaml

diff --git a/apps/opencloud/opencloud-ldap-schema-job.yaml b/apps/opencloud/opencloud-ldap-schema-job.yaml
new file mode 100644
index 0000000..156d5cd
--- /dev/null
+++ b/apps/opencloud/opencloud-ldap-schema-job.yaml
@@ -0,0 +1,68 @@
+---
+# One-shot Job to load the OpenCloud LDAP schema into the running OpenLDAP instance.
+# Connect via network LDAP as cn=admin,cn=config (rootdn of the config database).
+# Re-run by deleting and recreating the Job; idempotent (exits 0 if schema already present).
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: opencloud-ldap-schema-loader
+  namespace: opencloud
+spec:
+  ttlSecondsAfterFinished: 86400
+  backoffLimit: 10
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+      - name: schema-loader
+        image: osixia/openldap:1.5.0
+        command:
+          - /bin/bash
+          - -c
+          - |
+            set -e
+
+            echo "Waiting for OpenLDAP to be ready..."
+            until ldapsearch -x -H ldap://openldap:389 \
+              -D "cn=admin,dc=basicstack,dc=de" \
+              -w "$LDAP_ADMIN_PASSWORD" \
+              -b "dc=basicstack,dc=de" \
+              -s base "(objectClass=*)" dn 2>&1 | grep -q "result: 0"; do
+              echo "Not ready yet, retrying in 5s..."
+              sleep 5
+            done
+            echo "OpenLDAP is ready"
+
+            if ldapsearch -x -H ldap://openldap:389 \
+              -D "cn=admin,cn=config" \
+              -w "$LDAP_CONFIG_PASSWORD" \
+              -b "cn=schema,cn=config" \
+              "(cn={*}opencloud)" dn 2>/dev/null | grep -qi "opencloud"; then
+              echo "OpenCloud schema already present, nothing to do"
+              exit 0
+            fi
+
+            echo "Loading OpenCloud LDAP schema..."
+            ldapadd -x -H ldap://openldap:389 \
+              -D "cn=admin,cn=config" \
+              -w "$LDAP_CONFIG_PASSWORD" \
+              -f /schemas/10_opencloud_schema.ldif
+            echo "OpenCloud schema loaded successfully"
+        env:
+        - name: LDAP_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: openldap-admin-secret
+              key: admin-password
+        - name: LDAP_CONFIG_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: openldap-admin-secret
+              key: config-password
+        volumeMounts:
+        - name: schemas
+          mountPath: /schemas
+      volumes:
+      - name: schemas
+        configMap:
+          name: opencloud-ldap-schema
diff --git a/apps/opencloud/openldap-deployment.yaml b/apps/opencloud/openldap-deployment.yaml
index 9d66c38..89f9122 100644
--- a/apps/opencloud/openldap-deployment.yaml
+++ b/apps/opencloud/openldap-deployment.yaml
@@ -109,27 +109,6 @@ spec:
         - name: LDAP_REMOVE_CONFIG_AFTER_SETUP
           value: "false"
 
-        lifecycle:
-          postStart:
-            exec:
-              command:
-                - /bin/bash
-                - -c
-                - |
-                  # Wait for slapd to initialize
-                  sleep 10
-                  # Load OpenCloud schema if not already present
-                  if ! ldapsearch -Y EXTERNAL -H ldapi:/// \
-                    -b "cn=schema,cn=config" \
-                    "(cn={*}opencloud)" dn 2>/dev/null | grep -qi "opencloud"; then
-                    ldapadd -Y EXTERNAL -H ldapi:/// \
-                      -f /container/service/slapd/assets/config/bootstrap/schema/opencloud.ldif \
-                      2>&1 | tee /tmp/schema-load.log || true
-                    echo "OpenCloud schema load attempted"
-                  else
-                    echo "OpenCloud schema already present, skipping"
-                  fi
-
         ports:
         - containerPort: 389
           name: ldap
@@ -141,9 +120,6 @@ spec:
           mountPath: /var/lib/ldap
         - name: openldap-config
           mountPath: /etc/ldap/slapd.d
-        - name: opencloud-schema
-          mountPath: /container/service/slapd/assets/config/bootstrap/schema/opencloud.ldif
-          subPath: 10_opencloud_schema.ldif
 
         resources:
           requests:
@@ -174,6 +150,3 @@ spec:
       - name: openldap-config
         persistentVolumeClaim:
           claimName: openldap-config
-      - name: opencloud-schema
-        configMap:
-          name: opencloud-ldap-schema