c3fe072be5
The postStart lifecycle hook caused osixia/openldap to crash on startup: its init script does chown -R on /container/service/slapd/assets/, and the ConfigMap subPath mount there is read-only, killing the container. Remove the postStart hook and the schema volume mount from the OpenLDAP deployment. Add a standalone Kubernetes Job (opencloud-ldap-schema-job.yaml) that connects via network LDAP as cn=admin,cn=config and loads the schema after OpenLDAP is confirmed ready. The Job is idempotent (skips if the schema already exists) and retries up to 10 times on failure. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
---
|
|
# One-shot Job to load the OpenCloud LDAP schema into the running OpenLDAP instance.
|
|
# Connect via network LDAP as cn=admin,cn=config (rootdn of the config database).
|
|
# Re-run by deleting and recreating the Job; idempotent (exits 0 if schema already present).
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: opencloud-ldap-schema-loader
|
|
namespace: opencloud
|
|
spec:
|
|
ttlSecondsAfterFinished: 86400
|
|
backoffLimit: 10
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: schema-loader
|
|
image: osixia/openldap:1.5.0
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
echo "Waiting for OpenLDAP to be ready..."
|
|
until ldapsearch -x -H ldap://openldap:389 \
|
|
-D "cn=admin,dc=basicstack,dc=de" \
|
|
-w "$LDAP_ADMIN_PASSWORD" \
|
|
-b "dc=basicstack,dc=de" \
|
|
-s base "(objectClass=*)" dn 2>&1 | grep -q "result: 0"; do
|
|
echo "Not ready yet, retrying in 5s..."
|
|
sleep 5
|
|
done
|
|
echo "OpenLDAP is ready"
|
|
|
|
if ldapsearch -x -H ldap://openldap:389 \
|
|
-D "cn=admin,cn=config" \
|
|
-w "$LDAP_CONFIG_PASSWORD" \
|
|
-b "cn=schema,cn=config" \
|
|
"(cn={*}opencloud)" dn 2>/dev/null | grep -qi "opencloud"; then
|
|
echo "OpenCloud schema already present, nothing to do"
|
|
exit 0
|
|
fi
|
|
|
|
echo "Loading OpenCloud LDAP schema..."
|
|
ldapadd -x -H ldap://openldap:389 \
|
|
-D "cn=admin,cn=config" \
|
|
-w "$LDAP_CONFIG_PASSWORD" \
|
|
-f /schemas/10_opencloud_schema.ldif
|
|
echo "OpenCloud schema loaded successfully"
|
|
env:
|
|
- name: LDAP_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openldap-admin-secret
|
|
key: admin-password
|
|
- name: LDAP_CONFIG_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openldap-admin-secret
|
|
key: config-password
|
|
volumeMounts:
|
|
- name: schemas
|
|
mountPath: /schemas
|
|
volumes:
|
|
- name: schemas
|
|
configMap:
|
|
name: opencloud-ldap-schema
|